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The Honourable Guy Charbonneau 
The Speaker 
The Senate 
Ottawa 
June 30, 1993 
Dear Mr. Charbonneau: 
| have the honour to submit to Parliament my annual report. 
This report covers the period from April 1, 1992 to 
March 31, 1993. 


Yours sincerely, 


(Nl C Lf: 
Bruce Phillips 
Privacy Commissioner 
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The Honourable John Fraser, P.C., Q.C., M.P. 
The Speaker 
The House of Commons 
Ottawa 
June 30, 1993 
Dear Mr. Fraser: 
| have the honour to submit to Parliament my annual report. 
This report covers the period from April 1, 1992 to 
March 31, 1993. 


Yours sincerely, 


At Le | Liga, 
Bruce Phillips 
Privacy Commissioner 


Mandate 


The Privacy Commissioner is a specialist 
ombudsman—appointed by and accountable to 
Parliament—who monitors the federal 
government's collection, use and disclosure of 
its clients’ and employees’ personal information, 
and its handling of individuals’ requests to see 
their records. 


The Privacy Act gives the Commissioner broad 
powers to investigate individuals’ complaints, to 
launch his own complaint, and to audit 160-odd 
federal agencies’ compliance with the Act. He 
also conducts research on his own behalf or at 
the request of the minister of justice. 


Mission 


The Privacy Commissioner’s mission is 


to be an effective ombudsman’s office, providing 
thorough and timely complaint investigations to 
ensure Canadians enjoy the rights set out in the 
Privacy Act; 


to be an effective privacy guardian on Parliament’s 
behalf, performing professional assessments of the 
quality of the government’s adherence to the 
Privacy Act; 


to be Parliament’s window on privacy issues, 
arming it with the facts needed to make informed 
judgements through research and communications; 


to be the primary national resource centre for 
research, education and information on privacy. 
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Ten years after 


Publication of this report falls on the tenth anniversary of the 
coming into force of the federal Privacy Act and with it the creation 
of the Office of the Privacy Commissioner. The question naturally 
posed by such an occasion, of course, is whether the birthday is a 
happy one. 


Let us acknowledge the truth that any anniversary which the 
subject is still around to observe has something going for it. And 
certainly the progeny shows signs of promise. All the same, we’re 
disinclined to break out the cake and champagne. 


Call the mood one of subdued satisfaction. The office is gratified 
at having given ten years of useful service helping Canadians 
exercise their privacy rights in their relations with the Government 
of Canada. That service includes more than 7,500 investigations 
completed and findings rendered, almost 25,000 inquiries received 
and answered, and major audits of about one-third of the 
government’s information holdings conducted—no small 
achievement for an office which has never held as many as three 
dozen persons. 


Despite the sceptics’ direst predictions, law enforcement has not 
ground to a halt, there has been no sweeping abandonment of 
honest record-keeping and departments have not found 
themselves repeatedly before the courts. Nor have individuals’ 
requests to examine their personal information yet brought any 
department to its knees (although until it changed its policy, 
privacy applications had National Defence reeling). 


In fact, the Act, the complaints and audits have prompted many 
government institutions to better identify, organize and fine-tune 
their record-keeping—no small benefit in an era when virtually all 
government agencies have converted to electronic information 
systems. 


And this Office can lay some claim to stimulating public debate 
about data matching, control of the Social Insurance Number, the 


privacy implications of biotechnology, privacy principles in 
telecommunications services, controls on cellular telephone 
eavesdropping, privacy regulations in the financial sector and 
entrenching privacy rights in the Charter. 


Many of these initiatives demonstrate graphically the changing role 
of this tiny office. Mandated (and funded) only to investigate 
complaints against 160-odd federal institutions, the Commissioner 
is under pressure from Parliamentarians, the public and media to 
answer their privacy questions, to comment on the privacy 
implications of new programs and legislation, to appear before 
committees, and to speak out on the issues beyond his narrow 
mandate. To refuse is to court irrelevancy. To accede is to risk 
insolvency. Parliament’s privacy ombudsman strives to meet the 
demands but the budget is reaching crisis point. 


However, the climate of fiscal restraint has far broader privacy 
implications. Pressured to rationalize programs, improve service 
and cut costs, the government is aggressively pursuing ways of 
conducting much of its business electronically. Direct deposit of 
benefit cheques is just the beginning. Already the federal 
government is using electronic data interchange (EDI) to collect 
GST and personal income tax, to document immigrants and 
refugees and collect customs duties at the borders. 


One proposed new system is an interactive network of 
government information kiosks (“Infocentres”) which will allow 
clients to get information about government services, check job 
openings, apply for various programs and send change-of-address 
notices to participating departments. Once in place, the network 
can be substantially expanded to become a one-stop shopping 
centre for federal government services. 


These new electronic systems make a qualitative change to 
government information handling, including three ominous 
characteristics. The first is the need to have an identification card 
to receive the services, implying personal identification numbers, 


probably photographs and, quite possibly, fingerprints or some 
other biometric identifier. 


The second is the likely private sector involvement in any 
electronic interchanges of personal data—a sector without any 
legislated privacy controls. 


Finally, the costs of developing and delivering these new services 
could demand government consolidate its programs across 
departments—and perhaps even across federal-provincial 
jurisdictions. The walls between databases may come tumbling 
down, raising once again the spectre of the single government 
file—or profile—and the spectre of Big Brother. 


There is no shortage of work for a privacy commissioner. 
In a “‘technological trance” 


Any remaining temptation to celebrate is more than offset by an 
acutely painful awareness that increasingly we know only enough 
to realize how little we know. The office soends a good deal of 
time fighting fires. And in the wider world beyond the federal 
government and the limited reach of the Privacy Act, birthday 
celebrations may be premature. 


Viewed in that wider context, several developments in the past 
decade have effectively laid siege to privacy: 


¢ the explosion of computer technology, leaping from powerful 
mainframes, to personal computers, to electronic 
notebooks—each step bringing smaller, more mobile, more 
powerful and more accessible tools capable of being linked 
around the world, and the increasing sophistication of computer 
software; 


¢ Western societies’ uncritical acceptance of 
technology—including no systematic consideration of its impact 


on individual rights. We are in what has been described as a 
“technological trance’”—technology drives individuals’ rights 
rather than the other way around and the response, both in the 
private and public sectors, has been sporadic, tentative, and 
only marginally effective; 


e the rapid evolvement of biotechnology from a tool aimed at 
improving human health, to a powerful commercial and political 
weapon with an ominous potential for social surveillance and 
control; 


¢ the “commodification” of information—the packaging of 
information as a commercial good which in an increasingly 
competitive business environment is seen as lighting the path to 
economic competitiveness. 


And threats to informational privacy are only one part of the global 
privacy problem. Growing encroachments on physical privacy and 
increased physical surveillance round out the dilemma. Although 
perhaps beyond the general focus of this report on privacy of 
information, they form crucial elements of the chemistry of 
intrusion. 


How long will it be before calls for better crime prevention put 
cameras at major street corners in our urban areas? In the name 
of suppressing crime, Canadians may see their own lawful 
movements monitored by the state. Perhaps Orwell was not 
wrong. 


And the increasing use of technology to monitor workers is 
another omen. With each new form of surveillance we become 
less like individuals and more like automatons, monitored for 
defects and aberrant behaviour that will consign us to the reject 
pile or mark us for “corrective” measures. 


some experts feel that the game is already over, that technology 
has laid bare the life stories of us all, that Canadians should 


consign the concept of individual control to history, stop worrying 
and learn to live with and love the free flow of information. 


Privacy revealed 


Thankfully, public awareness of the impact of technology on 
privacy has also grown during the past decade. One useful 
development was the release in the Spring of 1993 of the first 
major national study of public attitudes on privacy issues. The 
study provides the first hard statistical evidence that Canadians 
are alive to the privacy issue—incontrovertible proof if any were 
needed that privacy is not some elitist concern or fringe issue. The 
fact that 52 percent of the population voices “extreme concern’ 
with the state of personal privacy ought to satisfy the most 
sceptical lawmaker or regulator. There is a strong public 
consensus on giving privacy a higher priority on the policy agenda. 


This survey, sponsored and financed by a consortium of private 
and public sector organizations (including this Office) also 
revealed that Canadians know what they need to protect their 
privacy in an information society. An overwhelming majority said 
they want some control over the gathering of information about 
them; to be told in advance when it’s being collected, by whom 
and for what purpose, and to have the right to consent to or 
refuse any transaction involving information about them. In short, 
they want those things that are the foundation of fair information 
practices, and which are absent from so much of today’s traffic in 
personal data. 


The Canadian public has thus grasped the essence of the privacy 
issue in the information age—personal control over the information 
which others know or can learn about them. The survey reveals a 
widespread sense of uneasiness; 61 per cent strongly agreed 
that ‘consumers have lost all control over how personal 
information about them is circulated and used by companies.” And 
60 per cent agreed that they have less privacy in their daily lives 
than they did ten years ago. Those whose business is studying 


this matter know only too well how justified Canadians are in 
harbouring that belief. 


Canadians are familiar with some highly-publicized privacy 
disasters including those resulting from monitoring and disclosure 
of cellular telephone conversations. But, in all probability, this is 
decidedly minor-league compared with the personal information 
about them that is routinely exchanged over computerized data 
bases and easily available to persons whose right to the 
information is, at best, debatable. 


Thanks to numerous congressional investigations, and a fairly 
aggressive media community, a considerable body of knowledge 
has developed in the United States detailing the scope and nature 
of information trafficking through computerized data bases. Horror 
stories abound. For example, in one of the latest works, Privacy 
For Sale, author Jeffrey Rothfeder (himself not a computer expert) 
relates how, with little difficulty, he gained access to the credit 
reports of former U.S. Vice-President Dan Quayle and television 
anchorman Dan Rather. 


He also recounts how every resident of a small New England town 
was listed as a tax evader by a credit reporting company, thanks 
to a computer input error. None of the 1,500 persons knew about 
this damning but inaccurate information until one of them, an 
affluent physician (presumably unused to being denied credit) 
looked into the matter. 


Given the similarity in Canadian and U.S. business practices one 
must assume the very real possibility of similar events taking 
place in Canada. Just to cite a few recent examples culled from 
the media: 


° a grocery chain began issuing “smart cards” to provide 
discounts to customers but neglected to tell them that their 
spending habits would be profiled and sold to direct marketing 
companies; 


* a company given sensitive medical files to destroy, sold the 
documents to a television production company where they were 
used on camera as props; 


¢ eight employees of a credit reporter misrepresented themselves 
as Revenue Canada employees to trace customers owing 
money to a provincial utility; 


¢ a chartered bank released clients’ card numbers, names, 
addresses and other personal data to a market research firm to 
test demand for new products; 


¢ aman checking the accuracy of his credit file found several 
inquiries about him from a lawyer in a province where he has no 
business or personal contacts. He has no legal recourse 
because there is no national credit reporting legislation and no 
privacy protection in the private sector; 


No-one reading any of these stories can rest easily. 
Leaving a “‘datashadow”’ 
Ten years ago, the first annual report of this office observed: 


...It has become trite to say that personal privacy is 
threatened as never before in human history... The confluence 
of new technologies with ever-insistent claims of the state to 
know, to be efficient, or both, has changed the qualitative and 
quantitative nature of the problem. 


If the threat was so well understood and clearly visualized 10 
years ago, what does it say about the situation today? It says that, 
with limited exceptions, the situation is decidedly worse. 
Everybody is acquainted with the enormous increase in direct 
marketing, for instance—the floods of advertising mail, the nightly 
phone calls. While these are nuisances (and some would argue, 
easily dealt with) they depend on access to highly-detailed 


personal profiles of customer prospects. Yet how many of us know 
what is in those profiles, or where the information came from, or 
who has them, or how accurate they are, or how secure they are, 
or, what is worse, to whom they might be sold? Not many. 


The fact is, ten year’s technology has transformed the inherent 
value of personal information. Every scrap of data about us, from 
such mundane “tombstone” information as name and age, to 
lifestyle data such as shopping habits or movie preferences, to 
such detailed medical information as our genetic makeup, is useful 
to somebody. Technology has furnished us with the tools to buy, 
manipulate, re-constitute and sell the details of others’ lives for a 
profit. Under the harsh glare of all this electronic scrutiny 
Canadians leave a ‘“datashadow’’—a trail of personal details and 
transactions which they cannot control. 


Consider the privacy implications of just two new technological 
developments: powerful new national information networks and the 
new personal communication devices. The first, the Canadian 
Network for the Advancement of Research Industry and Education 
(CANARIE) is a national initiative to stimulate creation of a 
high-speed digital network by the year 2000. The network will use 
optical fibres to connect the public and private sectors and citizens 
coast to coast. The federal government alone has earmarked 
millions of dollars over the next five years for the project. In five 
years, the amount of data being transmitted over electronic 
networks will grow 2000-fold. In effect, networks like these will 
transform information flow in the same way the transcontinental 
railroad did the flow of people and goods a century ago, and as 
modern highway networks did in this century. 


The optical superhighway will revolutionize communication, 
Carrying on its hair-thin glass fibres not just the words in electronic 
messages and computerized medical records but even such 
images as X-rays and Electrocardiograms. 


The next five years will bring yet another new telecommunication 
tool; personal communications networks. These networks will 
redefine how Canadians use the telephone. Numbers will be 
assigned, not to locations, but to individuals. Calls will be routed 
through radio transmitters, satellites and computers, tracking down 
the recipient and feeding the communication. And the new devices 
will be capable of handling voice, audio, text and graphic display. 


Useful as these devices may be, there are looming privacy 
problems. Not only is the content of the call at risk—this is 
wireless communication after all—but the more insidious invasion 
is the potential for surveillance. One has only to place a call and 
the telephone company will Know (and the billing records will 
show) where both caller and recipient were, and when. Will these 
records be available to government? To police? Wiil they be sold 
for marketing purposes? 


Facing the music 


Must we continue to argue about the desperate need to get a 
better handle on the business of information? Trailing far behind in 
the information race is any effort to produce some reasonable 
respect for the rights of the individuals whose personal information 
is the raw material for this industry. The ten years since the first 
privacy commissioner drew attention to the “threat” have seen the 
gap between problem and solution yawn ever wider. 


Frankly, it is becoming tiresome to hear people with a vested 
interest in unfettered information flow exclaim how “difficult” it is to 
protect privacy, when one suspects what they really mean is how 
“inconvenient.” 


One cannot fail to observe how readily solutions are found when 
specific cases force their way onto the public agenda. The recent 
example of intercepted cellular telephone calls leaps to mind. 
Once some sensitive political disclosures thrust the vulnerability of 


these devices on politicians and the public, the legislative 
machinery was remarkably quick to propose a remedy. 


So the evidence that solutions exist is recent and graphic. What is 
needed now is the will to deal with the issue in more than 
piecemeal fashion. One lesson the past ten years has taught: the 
pace of technological change makes unworkable proposing 
technical fixes for each new tool. We cannot envisage where 
technology will lead. What is needed is a privacy framework—a 
set of principles against which the new products and services can 
be measured. 


These observations in no way denigrate or diminish the value of 
much useful work now being done. On the contrary, the last 
annual report and this one draw attention to encouraging 
developments. Indeed there has been commendable action on 
several fronts which we report later. But the time has come for a 
more aggressive and co-ordinated approach to the problem of 
reconciling privacy protection with the informatics revolution. 


Canadians are entitled to respect for their privacy no matter what 
government jurisdiction, no matter what industry sector, and no 
matter what technology. The Commissioner pressed strongly 
during the recent constitutional debate for entrenching in the 
Charter an explicit right to privacy. But there were other priorities. 
Nevertheless, it is imperative to develop a set of principles to 
secure those rights. These principles should include: 


All governments should recognize that every Canadian is 
entitled to the data protection rights expressed in such 
documents as the OECD privacy protection guidelines 
and the federal Privacy Act. 


Broadly speaking, this means that personal information should be 
collected only when truly warranted, used only for the purposes 
set out beforehand, disclosed only in narrowly defined 
circumstances and accessible to the individual it concerns, 
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including the right to ask for correction. And the mere words in 
codes or statutes are not enough. Governments must be willing to 
establish a means of ensuring compliance with these tenets. 


All governments should recognize that such privacy 
rights should apply to public and private sector alike. 
Where such rights do not exist, the obligation rests with 
government to secure them. 


All Canadians are entitled to be fully informed about the 
potential impact of technology on their lives—what 
information is involved, what will be done with it—and 
how to regulate the use of technology. 


A commitment of this kind necessarily implies greatly improved 
public education. It also requires coordinated federal and 
provincial efforts to marshall the expertise capable of 
understanding and explaining the implications of technology on 
personal privacy. An equivalent to the U.S. Office of Technology 
Assessment might be a good starting point. The OTA helps 
legislative policymakers anticipate and plan for the consequences 
of technological change, and examine how technology affects 
people’s lives. 


The objective now should be to strengthen and extend the 
protection. Obviously, where more than one jurisdiction is involved, 
there must be leadership. It seems equally obvious that the 
government of Canada is best positioned to provide it. The 
Commissioner recommends that Parliament take steps to develop 
a national action plan aimed at achieving the objectives set forth in 
the proposed principles. 


The issue, remember, is not whether technology will continue to 
change our lives. It will. The issue is whether the changes will be 
governed solely by what the technology itself makes possible, 
without regard to the consequences for timeless and deeply-held 
values such as respect for individual autonomy and privacy. 
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All technology, from the invention of gunpowder to nuclear fission, 
has had the capacity to serve ends both ill and benevolent. The 
computer is no different. The decision, as always, is ours to make. 
But we no longer have the luxury of time—the next ten years 
could tell the tale. 
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Rising to the technology 
challenge 


Delivering services electronically 


The next decade will challenge all governments to be more 
accessible to their taxpayers; to provide information, services and 
benefits directly to the individual—all at a time of eroding 
resources. The federal government’s strategy to meet this 
challenge is to enhance its services by innovative use of 
interactive technologies. 


Given the range of programs and services the government 
delivers, the issues are complex and the investment costs 
enormous. And new technological advances often threaten to 
undermine individual control of personal information and to erode 
the protection offered by privacy laws. 


The federal government has recognized that, until now, technology 
and the technologists have operated in isolation to drive personal 
information management. But that is about to change. 

Government now acknowledges that technology simply offers us 
choices and that human values—including privacy—must be a part 
of developing and applying new information systems. 


To begin with, the government has created an electronic services 
initiative secretariat within Treasury Board to develop a 
coordinated vision and framework for introducing new electronic 
services. The secretariat will help departments use technology as 
their primary means of renewing services, determine what 
services can be delivered electronically and provide guidance on 
how best to implement that technology. 


Recognizing this Office’s ongoing concern and interest in the 
issue, Treasury Board has invited the Commissioner to work in 
partnership, providing advice on protecting personal information in 
the development of new electronic services and communication 
systems. 
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The invitation (gratefully accepted) recognizes the legitimate place 
for privacy in the debate. Reasonable privacy protection is not 
incompatible with technological change; there simply must be a 
convergence of disciplines that will build human values into the 
design and application of new systems. 


The Office also hopes to work with government officials to 
establish an interdepartmental working group on privacy and 
technology. 


As a first step, the Commissioner has proposed a “privacy 
checklist” to guide senior government officials during the design 
stage. While the search for a “framework” goes on, the proposal 
would at least ensure respect for clients’ and employees’ privacy. 
What follows is an informal sketch of some of the issues that need 
to be considered. 


A Privacy Checklist 


Openness/Transparency: Individuals must be thoroughly 
informed of their rights under the new technologies. Before 
introducing new systems, government must notify the public 
about the development, its objectives and extent, the type of 
data to be collected and used and the individuals who will be 
affected. Those individuals should also be given specific notice 
of their right to refuse to participate; to know what information is 
involved in the technological process; and to be made aware of 
the situations likely to develop around the use of the technology. 


Informed Consent: Individuals must be informed clearly and 
their consent obtained for all uses and disclosures of the 
information being processed. Individuals should also have the 
right to withdraw consent for uses or disclosures without 
penalty. 


Gate Keeping: Security measures must prevent misuse or 
inadvertent access to individuals’ data. This means incorporating 
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a combination of personal identification numbers (PINs) with 
internal security mechanisms for individual transactions. 


Matching: Systems shared by several users should be 
segregated internally to prevent possible merging or cross-over 
of personal information during any transaction. All transactions 
must be secure to and from the host computer. 


Access: Individuals must have the right of access to and 
correction of the information held about them as a result of any 
transaction. 


Non-Discrimination: New technologies must not limit the 
government services offered to a client and services offered 
electronically must respect the universality of government 
programs. (However, it is evident that even when participation is 
voluntary, participants may enjoy such advantages as faster 
service or service after normal business hours.) 


Beneficence: Government must acknowledge and affirm that 
new technologies are tools to help deliver service to 
individuals—not instruments to enable it to exert control over 
individuals’ information. (Of course, there are exceptions for the 
legally-mandated authority of government to properly control 
and administer its programs.) Government must resist the 
temptation to use any technology to conduct overt and covert 
surveillance on its citizens. 


Respect: All intermediaries must respect the principles of 
privacy ethics or laws—all participants in the process must be 
made aware of and adhere to those principles. 


Responsibility: Those entering information into systems must 
exercise the highest standard of responsibility to ensure the 
reliability of the system. 
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The checklist may strike some as a tall order—it may mean 
additional steps. But the privacy agenda can be incorporated into 
the technological arena in a way that will ensure taxpayers both 
improved government service and enhanced privacy protection. 


Other works in progress—smart cards 


This privacy checklist is drawn largely from A Privacy and Smart 
Card Framework, prepared by this Office as part of a users guide 
for the federal working group on implementing smart card 
technology. The paper sets out both an ethical framework for 
using smart cards as well as standards and guidelines that will 
take privacy protection into account in the applications design of 
smart card systems. 


The working group is attempting to identify the possible 
government applications for smart card technology and to suggest 
an operational framework in which the cards would function. 


The Department of Communications (after an earlier and 
unsatisfactory brush with the technology in its infancy in 1988) has 
begun several pilot projects. These include using the cards to 
control inventory of expensive high tech equipment at its 
Communications Research Centre and to replace the in/out 
employee board at the Canadian Conservation Institute. DOC also 
plans to use smart cards as electronic “money” in its stockrooms. 
The card will be loaded with an amount and each purchase will be 
deducted from the balance and the transactions recorded 
electronically. 


DOC is also considering using smart cards to store employees’ 
passwords for access to various computer systems. Employees 
will have to remember only their personal identification number 
which will give them access to their various system passwords. 
The passwords will be protected by the card’s encryption 
capabilities. 
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Given the cards’ ability to validate identity, employment status and 
security clearance, the most likely government-wide application of 
the technology is an employee card. The challenge will be to 
ensure it does not become a tracking device. However, the Office 
is convinced that government can devise standards and guidelines 
that will harness the technology, improve program delivery and still 
respect individual privacy. 


Telework 


The smart card group is just one of a number of committees on 
which privacy staff are working. Another is the Telework project 
committee. This committee will assess the results of a three-year 
pilot project to allow some employees to work at home and send 
the product to the employer electronically. 


The government has recognized that information technology can 
help us deal with wider social issues such as allowing employees 
to achieve a better balance between their work and personal lives, 
as well as reducing energy consumption and pollution and easing 
traffic congestion. 


The government has also acknowledged that while working at 
home can be beneficial, it also has some privacy implications. 
How will government protect clients’ (and other employees’) 
personal information while it is off the premises or in transit? And 
how will it ensure that working at home does not compromise 
employees’ private home life? 


Security safeguards for personal data must equal those provided 
at the work site. How much security will depend on the sensitivity 
of the personal information and the protection provided by each 
government agency. Clearly some agencies will allow teleworking 
with personal data; others will not. 
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The committee will examine the results of the project and its 
implications (not just for privacy). Its report is expected in late 
1995. 


Public Service Compensation System 


The Office will also review the new public service compensation 
project, a huge single database to store the pay and benefit 
information of all federal employees and pensioners. The 
implications of a single database are substantial; linking and 
merging of data, movement of data between departments, need 
for security safeguards and restricting access to those who need 
to know. The challenge will be to ensure that this system does not 
become the single, all-inclusive government profile. 
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Privacy on the Hill 


Telecommunications and privacy has been a recurring theme in 
these pages for several years. Again this year there are important 
developments to report—new legislative provisions to enhance the 
confidentiality of cellular communications and the Department of 
Communications’ publication of a set of telecommunications 
privacy principles. Two other legislative initiatives get mixed 
reviews: the struggle for privacy regulations in the financial sector 
and amendments to the Income Tax Act. 


Protecting cellular calls 


In his 1990-91 annual report, the Commissioner alerted Canadians 
to the growing threat to privacy posed by interception of cellular 
telephone calls. Two highly publicized cases—one concerning a 
British Columbia cabinet minister who resigned after a newspaper 
printed extracts from calls he made on his car phone and 
suspicion that cellular communications were intercepted during the 
Meech Lake Conference—served to illustrate the point. 


The Commissioner urged Parliament to act quickly to protect the 
privacy of cellular phone users. 


There is good news to report. Last December the government 
introduced Bill C-109, amending the Criminal Code and the 
Radiocommunications Act to make it illegal to intercept private 
cellular phone conversations maliciously or for gain, and to provide 
for both civil damages and criminal penalties. The Criminal Code 
amendments also expand the definition of a private 
communication to include encrypted radio based communications. 


Although the amendments do not ban cellular scanners, nor do 
they make it illegal to eavesdrop on cellular calls, they do give 
cellular telephones some of the protection of conventional 
“line-based” telephones. 


Much as the Privacy Commissioner would like to take some credit 
for catalysing the legislative process, he suspects the intercepted 


he. 


Wilhelmy-Tremblay call during the constitutional negotiations (and 
the ensuing media attention) did more to concentrate legislators’ 
minds. 


Some will argue that these measures do not go far enough 
because they do not ban scanning devices, an approach taken in 
the United States. While the Privacy Commissioner might prefer 
the American approach—and its clear statement that the 
interception itself is wrong—he is nonetheless gratified with any 
legislative measures to enhance the privacy of Canadians. 


Telecom Privacy Principles 


The second significant development in telecommunications this 
year results, in part, from an item in last year’s report which 
discussed the privacy impact of new technological advances and 
the seeming futility of trying to devise technical solutions for each 
new technical marvel. The Office had begun work on broad 
privacy principles and commended this approach—borrowed from 
New York state—to the Department of Communications in 
December 1991, and to the Senate Transportation and 
Communications Committee in June 1992. 


The combination of the Communications minister's commitment 
and his department's resources and expertise have produced a 

framework of privacy principles to guide the telecommunications 
industry. These principles emerged for the most part out of two 

Significant events. 


First, Bill C-62, the proposed new Telecommunications Act was 
introduced in February 1992. It sets out as one of eight policy 
objectives for the government: 


“... to respond to the economic and social requirements of 


users of telecommunication services, including the protection 
of the privacy of individuals.” 
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Second was the caller |.D. decision by the CRTC. This decision, a 
reversal of an earlier verdict, put to rest perhaps the most 
controversial issue arising from the introduction of Call 
Management Services by the telephone companies. In the end, 
the CRTC required all companies in its jurisdiction to provide free 
per-call blocking for callers who did not want their numbers 
displayed. 


Caller ID and cellular telephones are two good examples of the 
double-edged nature of technological advancement. In each case, 
important benefits and conveniences were made possible by new 
technology but, without some special arrangements, both carried 
with them significant potential loss of personal privacy. With 
privacy principles to guide it, the CRTC might have foreseen the 
problems with Call Management Services and dealt with them 
during the first review. This would have avoided the fuss and the 
need to review and overturn its earlier decision. 


To implement the principles the minister has chosen a voluntary 
approach. There are obvious benefits. One; it allows industry to 
tailor a privacy protection framework that will suit its specific 
needs. Two; it provides a solution that transcends jurisdictional 
boundaries—all players whether private, public, provincially 
regulated, or federally regulated can participate. Three; it will be 
jointly funded by public and private concerns. 


Key to the department’s partnership approach is two bodies: a 
telecommunication privacy foundation and a telecommunications 
privacy council. The foundation will bring all the players together; 
the council (representing industry and consumers) will receive and 
adjudicate complaints. 


However, this approach lacks specific statutory underpinnings and 
does not establish an independent dispute resolution 
mechanism—two elements necessary for an unconditional 
endorsement by the Privacy Commissioner. 
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Nevertheless, if industry commits to this approach, it may provide 
an adequate privacy protection framework. The Communications 
minister announced his willingness to consider a legislated 
solution if there is no support for this concept. With that added 
caveat, the Privacy Commissioner supports the initiative. 


Amending the Income Tax Act 


The Privacy Commissioner was also interested in amendments to 
the Income Tax Act and Excise Tax Act (bills C-92 and C-112). If 
enacted, these amendments would allow any Revenue Canada, 
Taxation official to use taxpayer information to supervise, evaluate 
or discipline a departmental employee. 


The Commissioner raised two important concerns about these 
proposals. First; they designate Taxation employees as a new 
class of federal employee, subject to government monitoring and 
controls that differ from those of other employees. And second, 
they diminish existing confidentiality rights of all taxpayers 
because their files could be used in proceedings unrelated to the 
income tax process. 


However, safeguards were included in the latter case to protect 
the confidentiality of taxpayer information in legal proceedings. 
The safeguards provide for in camera hearings, banning the 
publication of the information, concealing the identity of the 
taxpayer, and sealing the record of proceedings. Such a use of 
their files may, nonetheless, come as a Surprise and source of 
concern among many taxpayers. The Commissioner 
recommended that prior to implementing such a system, Revenue 
Canada should consider acquainting taxpayers with the change. 


Of greater concern was the first proposal designating Revenue 
Canada employees as a special class. Although the Commissioner 
recognizes the need to ensure the integrity of the tax system, he 
considered the proposals, as drafted, apply too broadly and open 
up the potential for abuse of employees’ privacy. They could be 
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interpreted as allowing a supervisor the arbitrary power to retrieve 
and examine an employee's tax return at will. Thus, for example, 
should a Taxation employee be involved in a grievance 
proceeding against a supervisor (on matters unrelated to income 
tax collection), the supervisor could examine the employee’s tax 
return and use it to threaten or intimidate. 


Some occupations and professions often demand different or 
enhanced standards of behaviour of their members. However, the 
Commissioner thought that Taxation could achieve the desired 
level of integrity without resorting to such broad measures. 


For example, the department could establish stringent criteria 
under which the management could examine employee tax files. It 
could define conditions of reasonable cause to avoid the potential 
for fishing expeditions in employees’ personal and sensitive files. 


As well, the department could devise a protocol allowing only 
senior program officials (not supervisors or personnel staff) to 
review employee files and determine whether to release 
information for the personnel uses envisaged. Revenue Canada 
should not contemplate such examination and disclosure for 
routine supervision and evaluation but only “for cause” to be 
defined in law. 


At best, the present proposals represent a derogation from 
existing privacy rights without a corresponding protection of the 
employees’ interests. Such measures should not be taken lightly 
and certainly not without a full and open public debate. They 
create the potential of a privacy underclass of citizens whose 
legitimate concerns are equally as important as the integrity of the 
taxation program. The privacy of their files is a priority 
consideration for Taxation employees. Any system that envisages 
diminishing that privacy demands stringent safeguards. A balance 
is necessary. 


23 


This apparent lack of balance between competing interests was 
not lost on members of the Commons Finance Committee. The 
amendments were initially voted down by the committee, but 
reinstated at the report stage by the government. 


In letters to the Privacy Commissioner and the Committee, the 
department acknowledged that the proposals fundamentally alter 
existing confidentiality provisions, but insisted that 


It is our duty to ensure that Revenue employees conduct 
themselves in a manner appropriate for persons who have 
privileged access to the tax system. While the vast majority do, 
it would be unfair to other taxpayers if a Revenue employee 
who had abused the system or who was demonstrably 
incompetent was shielded from normal disciplinary action simply 
because the relevant tax-related evidence could not be used or 
provided. 


The department argued that the amendments provide additional 
privacy protection since taxpayer information could only be used if 
it is relevant to, and solely for a purpose related to supervision, 
evaluation and discipline. As well, the department proposed to 
issue guidelines to deal with the Privacy Commissioner’s 
objections. Officials assured the Commissioner that both he and 
union officials would be consulted on the guidelines before they 
are finalized and implemented. 


The Commissioner accepted the department’s offer to work on a 
set of mutually-agreed safeguards, in cooperation with the public 
service unions concerned. This will mark the first time this Office 
has worked directly with a department to improve the privacy 
aspects of its employee administration process. The results seem 
certain to be of interest both to the bureaucracy and to Parliament. 
Pending the outcome, the Commissioner acknowledges Revenue 
Canada’s ready response to his concerns. 
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Two further amendments also caused the Commissioner some 
concern; those to section 241 of the Income Tax Act proposing 
that an official “may” provide access to taxpayer information for 
the purposes of section 45 of the Privacy Act (and similar wording 
for section 295 of the Excise Tax Act). These provisions could 
have been interpreted to mean departmental officials had the 
discretion to refuse to disclose taxpayers’ information to the 
Commissioner's staff during a complaint investigation. 


Revenue Canada agreed that these sections should be interpreted 
simply as enabling department officials to allow the Privacy 
Commissioner to carry out his duties without Revenue Canada 
being in breach of those sections of the Income Tax Act or the 
Excise Tax Act. 


Privacy in Banking 


The Commissioner reported last year that a great divide may have 
been traversed with the introduction of two pieces of 
legislations—a bill dealing with banks and financial institutions, 
and a new Telecommunications law. As reported earlier, recent 
initiatives now offer more than a mere glimmer of hope that 
privacy will be adequately protected in telecommunications. The 
news is not aS encouraging for the banking provisions. They seem 
to be snagged somewhere along the divide. 


In April 1992, the Commissioner appeared before the Senate 
Banking Committee to urge Parliament to seize the opportunity to 
draft regulations that would protect privacy in the banking world. 
The Committee was quick to pursue this suggestion and with the 
help of Professor David Flaherty of the University of Western 
Ontario drafted a set of regulations. These regulations are based 
on existing Privacy Act provisions but adapted for the banking 
industry. 


As promised, the Commissioner was invited to reappear before 
the Committee last December. He reiterated his strong support for 
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embodying basic privacy protection standards in the legislation. As 
well, he contended that no privacy protection scheme could 
command public confidence without an independent dispute 
resolution mechanism—one with the power to investigate 
complaints and to review both the information holdings and 
information management practices of the financial institutions. As 
of this date, the Senate Committee has not issued its final report. 


A strong private sector lobby led by the Canadian Bankers’ 
Association advocates a completely self-regulatory approach. The 
Commissioner while no great fan of government intervention for its 
own sake, continues to believe that basic common standards and 
independent oversight are necessary to guarantee fairness and 
transparency in this field. 


26 


...On the Streets 


Privacy revealed: the Canadian privacy survey 


For the first time in its ten-year history, the Commissioner’s office 
has reliable analysis of Canadians’ expectations, knowledge and 
fears about their privacy—and they feel “under siege.” 


The results of the first broad spectrum study of Canadians’ views 
about privacy are long overdue. They are dramatic confirmation of 
people’s awareness and concern about the threats from 
technological, commercial and social changes. 


Ninety-two per cent of Canadians expressed some concern about 
their privacy—52 per cent were “extremely concerned’— 
comparable to extreme concern about the environment (52 per 
cent) and unemployment (56 per cent) and well ahead of worries 
about national unity (31 per cent). 


The majority of Canadians (60 per cent) feel they have less 
privacy than they did a decade ago—40 per cent feel “strongly” 
that their privacy has eroded. Four out of five respondents said 
that computers are reducing our privacy and 54 per cent are 
extremely concerned about the linking of personal information 
from one electronic data base to another. 


Perhaps the most startling finding for the Commissioner’s Office is 
that, whether or not they have ever read a privacy act or heard of 
a privacy commissioner (and as the survey says, few have) 
Canadians have put their fingers on the fundamentals of privacy 
protection. And the watchwords are knowledge, control and 
consent. 


One of the key patterns evident in the findings is the greater the 
respondents’ sense of control and knowledge of the process, the 
greater their level of comfort. This need to participate and control 
is evident in the following findings: 


¢ 81 per cent feel strongly that they should be notified in advance 
when information about them is being collected; 
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¢ 83 per cent strongly believe that they should be asked for 
permission before information about them is passed from one 
organization to another; 


¢ 87 per cent strongly agree that when information about them is 
collected they should be told what it will be used for; 


¢ 72 per cent said that being in control of who can get information 
about them is extremely important, and 


¢ 67 per cent feel controlling what information is collected about 
them is extremely important. 


The survey (entitled Privacy Revealed) also revealed a very strong 
desire for action. Although respondents were prepared to consider 
some creative approaches such as partnerships between 
government and business—and also to take responsibility 
themselves—it was clear that pure self-regulation by business (the 
status quo) was the least acceptable at 26 per cent. The strongest 
support was for the active involvement of government. 


The survey was conducted by Ekos Research Associates Inc. of 
Ottawa on behalf of the Privacy Commissioner, AMEX Bank of 
Canada, Canadian Bankers’ Association, Consumer and 
Corporate Affairs Canada, Communications Canada, Equifax 
Canada, Statistics Canada and Stentor Telecom Policy Inc.. Ekos 
surveyed 3000 Canadian households;—the results are valid within 
a range of +/- 1.8 points, 19 times out of 20. The study will 
establish a base line against which future studies can be 
measured. 


A survey of this size and rigour would have been impossible for 
the Commissioner’s Office alone and likely for the other federal 
partners. The Commissioner is grateful to Ekos Research for the 
quality of its analysis and the many extra hours spent; to Stentor 
Telecom Policy for the initiative, financial commitment and staff 
work, and to Communications Canada for the contributions of its 
policy staff. It would not have been possible without them. 
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...1n the Courts 


Privacy Commissioner v. Canada Post Corporation 


For the first time in the Acfs ten-year history, the Privacy 
Commissioner has asked the federal court to review an 
institution’s denial of access to personal information. 


The Commissioner asked the court to determine whether the 
complainant has the right to know the identity of a witness who 
provided testimony against him during a grievance hearing, and on 
the basis of which the grievance was denied. 


Canada Post initially denied the man both the name and the 
substance of the witness’s testimony because it had been 
“prepared or compiled in the course of an investigation” and its 
release would injure the conduct of a lawful investigation 
(paragraph 22(1)(b)). He complained to the Commissioner. During 
investigation, Canada Post relented and provided the testimony 
but removed any identifying details and refused to name the 
witness. 


The corporation argued that revealing the name would be 
“injurious to enforcement of any law” since the information was 
prepared during an investigation and it would identify a confidential 
source of information. It also maintained that revealing the 
witness’s identity would offend the Act’s provision against 
disclosing personal information about someone other than the 
complainant (section 26). 


The Privacy Act defines personal information as including “the 
views or opinions of another individual about the individual.” In 
other words, if Mary makes a comment about John, that is John’s 
personal information. The Commissioner has asked the court to 
consider the distinction between a confidential source who 
provides information during law enforcement and a witness whose 
testimony is heard as part of an administrative process. The court 
will also be asked to assess what harm disclosure could cause 
once this type of administrative investigation is completed. 
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No date has been set for the hearing. 


During the year courts issued decisions in two cases dealing with 
privacy matters. 


SINs for birth registration 


The first concerned Prince Edward Island’s requirement that 
newborn babies be issued a Social Insurance Number, reported in 
the Commissioner’s 1991-92 annual report. 


Briefly, a couple refused to apply for a SIN for their newborn baby 
and were subsequently denied all claims for the baby’s medical 
care because she did not have a SIN (the province’s health care 
number). The parents argued that requiring someone to have a 
SIN to be eligible for medical benefits violated the Charter, denied 
equal treatment under the law and breached a person’s 
reasonable expectation of privacy. 


The court ruled against the parents on each ground. However, of 
particular interest to this Office was the court’s comment on the 
Privacy Act and its application to a 1970 federal-provincial 
agreement under which Employment and Immigration Canada 
issues SINs for births registered in PEI. 


In the court’s words, “...the province does not have the right to 
receive information on individuals’ Social Insurance Numbers from 
the Government of Canada without the consent of the individual, 
as it has not met the provisions of subsection 8(2) of the Privacy 
Act.” 


The Commissioner reviewed the decision which buttressed his 
own suspicion about the validity of the 1970 agreement (made 
well before the Privacy Act came into force). He wrote again to 
EIC, this time asking it to stop issuing SINs on the basis of the old 
agreement. EIC and Health and Welfare Canada have both 
committed to recommending PEI stop using SINs as health 
numbers and have undertaken to help the province adopt its own 
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personal identifier for health care. However, EIC will await the 
outcome of the parent’s appeal of the decision. 


Patient access to medical records 


In another case, the Supreme Court of Canada ruled that a New 
Brunswick patient had the right to see all the documents in her 
medical file, not just those created by her current doctor. 


The doctor had provided copies of all the documents she had 
prepared, but refused to allow the patient to examine any created 
by other medical practitioners. The doctor considered that would 
have been unethical since the records were someone else’s 


property. 


The court concluded that the physical records were indeed owned 
by the doctor. It also affirmed the physician’s duty to protect the 
confidentiality of a patient's medical file unless the patient or the 
law authorized otherwise. But the court made it clear that the 
doctor-patient relationship “is fiduciary in nature” and information a 
patient reveals to a doctor “remains, in a fundamental sense, 
one’s own.” 


The court observed that this “trust-like beneficial interest of the 
patient in the information indicates that, as a general rule, she 
should have a right of access to the information and the physician 
should have a corresponding obligation to provide it.” 


The right is not absolute. The court acknowledged that a doctor 
might have reason to believe it would not be in the patient’s best 
_ interest to see some material. However, the decision puts the 
onus on the physician to justify denying a patient access. 


While the case has limited immediate impact—applying only to 
those jurisdictions without specific legislation on patient access—t 
is important re-enforcement by the nation’s highest court of 
individuals’ proprietary interest in their personal information. 


31 


..1n the Labs 


Biotechnology update 


Two major developments occurred in drug testing at the federal 
level this year. In May 1992, regulations authorizing a wide range 
of drug testing programs in the Canadian Forces came into effect. 
In November, the Corrections and Conditional Release Act came 
into force, also authorizing a wide range of testing programs for 
inmates and offenders released into the community. 


Drug testing remains a concern of this Office. Alcohol, not drugs, 
poses the greatest threat to workplace and public safety. Yet, the 
government continues its march towards drug testing. 


Unlike alcohol testing, drug testing (urinalysis) cannot measure 
impairment. Even alcohol testing is an imprecise measure and 
the legal limit is arbitrarily set. Drug testing can measure only 
past drug use. It cannot tell how much was used, exactly when 
(only within days at best, and weeks at worst), or whether the 
drug impaired the user at the time. Most important, it cannot tell 
whether the user is now impaired. Thus, drug testing cannot 
reveal the only information that has any relevance—present 
impairment. 


Simply put, drug testing will not tell air travellers whether their pilot 
is impaired. It will tell them only that the pilot has used a drug 
sometime in the past—information no more useful than knowing 
that their pilot may have had something to drink or been impaired 
by the flu or jet lag within the last month or week. Drug tests give 
no indication of the pilot’s present ability to fly safely. 


This Office is not insensitive to concerns for public safety. It 
accepts that some circumstances justify privacy intrusions. The 
legislation allowing the taking of breathalyser tests for alcohol 
impairment is a good example. But drug testing has no such 
justification. Instead, it represents a major new type of 
state-sponsored intrusion into the human body. Even persons 
charged with murder cannot be forced to surrender bodily 
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substances for forensic purposes, so great has been the law’s 
protection of the integrity of the human body. 


In short, drug testing is a major intrusion that is not offset by any 
significant benefits. 


Canadian Forces’ testing programs 


Of particular concern is the drug testing program now underway in 
the Canadian Forces. This Office’s 1991 report, Drug Testing and 
Privacy, questioned the need for testing within the Canadian 
Forces. If anything, our conviction that testing is not justified has 
strengthened. The results of a 1989 survey of Forces’ members 
demonstrated clearly that use of alcohol, not illegal drugs, poses 
the greatest potential drug-related safety problem in the CF. The 
simplest way to explain the 1989 survey results is as follows: for 
every 1000 members of the Canadian Forces asked which drugs 
they had used in the past month 


three would say they had used LSD; 

five would say they had used cocaine; 

25 would say they had used marijuana, and 
780 would say they had used alcohol. 


If there are drug-related safety problems in the CF, they stem to a 
far greater extent from alcohol, not illegal drugs. Yet the drug 
testing program almost exclusively targets the illegal drugs. The 
1989 survey showed clearly that illegal drug use in the Canadian 
Forces is not of such magnitude that it justifies a massive intrusion 
into the bodies of its members through drug testing. The 
Commissioner has expressed his reservations to National Defence 
officials and written to the Chief of Defence Staff, all to no 
apparent avail. The Commissioner does not intend letting this 
issue drop. 


A subsequent “blind” test (on December 8, 1992) collected more 
than 5,500 urine specimens at 15 locations in Canada and in 
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Germany. These samples were then analyzed for cannabinoids 
(e.g., Marijuana), cocaine, opiates, amphetamines and 
phencycladine (PCP). 


The results of the blind testing (although not strictly comparable 
with the results of the earlier survey), Support the Office’s position 
that members’ rates of drug use are very low, and that the 
massive testing program introduced to detect those drugs is an 
unwarranted intrusion. 


Testing inmates and parolees 


The Corrections and Conditional Release Act, which came into 
force in November 1992, introduces a broad range of drug testing 
programs for inmates and those who have been released into the 
community. The justifications advanced for testing inmates and 
parolees differ from those for testing others. The drug trade in 
prisons is said to lead to increased violence and coercion within 
prisons. Reducing the demand for drugs through drug testing, it is 
argued, may help reduce these problems. 


This Office certainly does not oppose reasonable measures to 
reduce violence within prisons. However, it remains to be 
demonstrated that drug testing will accomplish this. If it does, the 
violation of privacy may be warranted. If it does not, we hope that 
the Solicitor General of Canada will be sufficiently open-minded to 
reconsider the program. 


Drug testing in prisons could pose one particularly grave danger. 
Drug users worried about being caught may switch from drugs 
that can be detected long after use (like marijuana) to those 
detectable for only a short period (like heroin and cocaine). This 
means switching from a smokable drug to one usually 
administered by injection. Given the scarcity of syringes (and 
syringe cleaning materials) in prisons, this could greatly increase 
the risk of HIV infection. While not strictly a privacy matter, 
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anything that increases the risk of HIV infection is yet one more 
argument against violating individual privacy through drug testing. 


Transportation industry employees 


A third major testing issue concerns the transportation industry. 
As this report goes to press, drug testing legislation aimed at 
safety-sensitive transportation positions appears unlikely to even 
be introduced before Parliament's Summer recess. 


Nevertheless, the Commissioner’s concern bears repeating—the 
proposed transportation testing program constitutes overkill. It 
also unnecessarily sacrifices hard-won privacy rights. There is 
good news: the minister of transport has decided not to proceed 
with the department’s planned random testing. Still, several other 
aspects of the testing program remain objectionable. 


Testing athletes 


The Office continues watching developments in drug testing in 
sport. Athletes too have basic human rights, including the right to 
privacy. Drug testing programs may help to make sport somewhat 
more fair, but at what cost? Particularly worrying is the response 
of a few to a recent Canadian Centre for Drug-free Sport 
questionnaire—they identified blood testing for drugs as an 
appropriate activity for the Centre. Urinalysis is intrusive, but at 
least it does not involve entering a person’s body to remove body 
fluids, as blood testing would. It is frightening to think that some 
people will contemplate violating the very physical integrity of 
human beings, an integrity protected for centuries by law, in the 
name of men and women playing games. 


Genetic Testing 
The Office continues to follow rapidly occurring developments in 


genetic testing and their impact on privacy. Although our 1992 
report, Genetic Testing and Privacy, has received national and 
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international praise, genetic privacy concerns have fallen behind 
other public issues. The immediacy of the dangers of unregulated 
genetic testing risks being overlooked. 


Genetic technology will not wait for us to catch our breath. 
Genetic discoveries are breaking at an ever-increasing rate. 
Scientists and biotechnologists will continue to develop new, 
cheaper and more accurate genetic tests to identify physical and 
behavioral traits. Some traits, if revealed to employers, insurers 
and governments, will almost certainly stigmatize individuals or 
precipitate discrimination against them simply on the basis of their 
genes. 


By waiting, we come ever closer to losing control over our own 
genetic information—information about the very essence of our 
beings. The Commissioner urges Parliament to take up this issue 
before a post-Orwellian genetics free-for-all engulfs us. 
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..Mmere and There 


Regular readers of these reports will know that the Office monitors 
privacy protection elsewhere in this increasingly interconnected 
world. The past year has seen progress both at home and abroad. 


In the provinces: Quebec 


In December 1992, the Quebec government introduced Bill 68, an 
act to extend privacy protection to the private sector. 


If passed, this will be the first legislation in North America to 
regulate private sector collection, use and disclosure of client and 
employee personal data. 


The legislation would require businesses to limit collection of 
personal information to specific stated purposes. Clients could not 
be denied goods or services for refusing to provide personal 
information unless the details were required by law or to fulfil 
contractual obligations. 


The bill would also require businesses to tell clients what 
information is held about them, to keep the data accurate, 
up-to-date and complete, and to obtain the subject’s consent for 
any disclosures to third parties that are inconsistent with the 
stated purpose (unless specifically allowed by the legislation). 


Consumers will be able to opt out of telemarketing or mail 
solicitation and to find out where the business got their personal 
information. And companies must have appropriate security 
measures in place to protect the confidentiality of personal 
information. 


Specific provisions deal with credit reporting companies which 
must register with the provincial access and privacy commission 
and publish their activities in the newspapers. The bill sets out 
fines for non-compliance ranging from $1,000 to $10,000, 
depending on the offence. 
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The Quebec privacy commission will play a lead role in overseeing 
administration of the act. It will investigate complaints and issue 
binding decisions (although questions of law and jurisdiction may 
be appealed to the courts). The Commission will also have an 
education mandate and can encourage and help business develop 
internal privacy codes. 


A legislative commission held public hearings and is now 
reviewing the bill and considering specific amendments. 


At least one question remains to be answered: will the legislation 
apply to federally regulated businesses such as banking, 
transportation and communications? If so, will these sectors 
provide the same level of privacy protection to other Canadians? 


British Columbia 


In June 1993, British Columbia’s legislature passed the province’s 
first Freedom of Information and Protection of Privacy Act. 


The act (which takes effect in October 1993) is broadly similar to 
other provincial legislation and will apply to BC government 
bodies. However, before even taking effect, the act is being 
amended to extend its provisions in October 1994 to local 
government bodies such as school boards, hospitals and 
municipalities. Other amendments would see self-governing 
professional bodies covered by Spring 1995. 


Complaints will be handled by a commissioner—part ombudsman, 
part tribunal—allowing for both mediation and (if it fails) 
enforceable orders. Unlike the federal ombudsman, the 
commissioner will have access to Cabinet confidences to assess 
the validity of exemption claims. He or she has a specific mandate 
to carry on education and research. However, the commissioner 
too must live with time limits; reviews must be completed in 90 
days. There are some undeniable benefits to having order 


38 


powers—they will allow the commissioner to impose deadlines on 
reluctant government agencies. 


Overseas: the European Community Draft Directive 


Of course, privacy developments can have implications well 
beyond national or regional boundaries. 


The most obvious illustration is the European Community’s (EC) 
draft directive on protecting personal data. Earlier reports have 
cautioned Canadian governments and business about the potential 
implications of strict European privacy rules on transfer of 
personal data in and out of the community—particularly to North 
America. 


During the past year, the EC directive came under intense 
pressure from business, particularly the direct marketing and 
financial sectors. Business identified several problems: the 
directive’s restriction on transfer of personal data to non-EC 
countries without “adequate” protection; the need for the subjects’ 
express consent before their data is processed or transferred; 
“unnecessarily burdensome” obligations to notify the data 
protection authorities; and lack of flexibility for member states to 
use various kinds of regulation or codes to implement the data 
protection principles. 


The lobbying had some effect and, in October 1992, the EC 
issued an amended directive. The revised version continues to 
require “adequate” protection in non-EC countries receiving EC 
residents’ data. And it has dropped any formal distinction between 
the public and private sectors—the rules are the same. However, 
there is added flexibility. The directive now allows transfers if the 
subjects consent, if the data is needed to satisfy a contract 
between subject and controller (notice must be given to the 
subject), and if an important public interest or the vital interests of 
the subject are at stake. 
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The amended directive will also allow EC countries to consider the 
type of data, the reason for processing, any sectoral codes, as 
well as legislative provisions, and even “professional rules” when 
assessing the “adequacy” of non-EC countries privacy protection. 


It is not clear how Canada’s patchwork of public sector legislation 
and private sector codes (or statements of good intent) will 
measure up. 


OECD Experts Privacy Briefing 


Technology is usually blamed for eroding rather than enhancing 
privacy. But a November 1992 meeting of the OECD 
(Organization for Economic Cooperation and Development) turned 
the problem on its head and looked at the potential of technology 
to protect personal data. The OECD invited several experts to 
brief government participants on using new technologies and 
processes to protect personal data in electronic systems. 


Some of the technical possibilities include encryption (coding), 
trusted systems (specially designed to meet specific security 
objectives), blind signatures and electronic cash (verifying financial 
transactions without tracing the individual) and networks which 
allow transmissions between parties without their being 
“observed.” It is unlikely that any system will be foolproof but 
these meetings are an important step in building controls into the 
systems themselves. The group expects to meet again. 


As well, the OECD passed its new Guidelines on Information 
Security Systems which will soon be released. 


Privacy in Hong Kong... 
The Hong Kong government recently issued a discussion 
document examining the Crown Colony’s current privacy 


protections and outlining a framework for a privacy protection bill. 
The draft was produced by a Law Reform Commission 
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sub-committee, representing academia, law, telecommunications, 
banking, trade, police and the media. 


The draft contains the eight OECD principles and much of the 
spirit of the latest EC draft directive. There is a comprehensive 
description of what constitutes personal information and its 
jurisdiction will include both the public and private sectors. The 
draft also deals with sectoral codes, data matching, direct 
marketing, personal identifiers, and transborder data flow. Two of 
its strengths appear to be provisions for ensuring that data 
subjects consent to uses and disclosures, and allowing individuals 
to opt out of direct marketing activities. 


With Hong Kong’s reversion to mainland Chinese control in 1997, 
the future of the proposed bill is uncertain. 


..and New Zealand 


New Zealand is in the midst of considering a comprehensive 
privacy act to replace a number of statutes, each with limited 
jurisdiction. The bill contains 12 privacy principles, expanding on 
those contained in the OECD principles and the EC directive. It 
will cover both the public and private sectors and it tackles such 
subjects as private sector codes of practice, public registers (for 
example, electoral lists) and data matching. 


The bill would allow the privacy commissioner to issue emergency 
codes of practice. It also sets out comprehensive data matching 
requirements for the public sector, requires users to verify the 
accuracy of personal data before processing, and establishes a 
broad scheme of damages to compensate those whose privacy is 
breached. 


There are, however, some notable omissions: organizations have 
substantial discretion to determine what are ‘‘trivial’” demands and 
they may charge fees to process access, correction and notation 
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requests. And it appears that criminal offenders will have no 
access and correction rights. 


The bill is awaiting second reading and is expected to take effect 
on July 1, 1993. 
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...In the Private Sector 


The CSA model code 


Last year we reported the Canadian Standards Association’s 
initiative in developing a model privacy code to serve as a 
minimum standard for private sector handling of personal 
information. The model code holds promise for some meaningful 
privacy protection without resort to legislation. 


CSA formed a committee whose goal is to develop and then 
promote a model code based on the OECD guidelines. The 
members (including this Office) represent finance, insurance, 
direct marketing, telecommunications, information technology, 
utilities, credit reporting, consumers and federal and provincial 
governments. 


Work continues apace. Committee working groups have prepared 
documents explaining each of the OECD principles in everyday 
language and identifying the issues that must be dealt with to 
implement each principle. A drafting committee will now 
amalgamate and edit all the material into a single draft model 
code which is expected to be ready for committee review later this 
year. 


One important aspect of any code is the oversight mechanism. 
The committee expects to make specific recommendations on 
several possible options for registering or certifying industry 
specific codes. 


Privacy staff were also resources for CSA’s consumer advisory 
panels which provide input and public review of the standards. 
Recommendations from these panels will help the committee 
reflect the privacy concerns of the wide range of interests and 
occupations beyond its immediate membership. 
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Canadian Direct Marketing Association 


Also reported last year was the CDMA’s decision to develop its 
own specific privacy code (CDMA is also a member of the CSA 


group). 


The CDMA has done it. The code, released in January 93, was 
developed following two years of research and consultation with 
consumers, industry and privacy experts. Prior to the code, CDMA 
had offered consumers the option of removing their names from 
all CDMA members’ lists. But the new code goes further. It gives 
consumers a means of controlling the transfer of marketing 
information about them by allowing them 


¢ to decline to have their names used; 


¢ to know the source of their information, what information it holds 
and to request correction of errors; 


¢ to control the subsequent use of their information by third 
parties; 


¢ to be reassured about the security of their information; 


¢ to benefit from more stringent protection for sensitive 
information, and 


¢ to complain to the CDMA if a member breaches the code. 


The code demonstrates what commitment to an idea can produce. 
CDMA members understand the importance of consumer 
confidence, control and consent for the health of their industry. 
The code is not perfect; there are no limits on collection (as 
envisaged by the OECD guidelines) and the oversight mechanism 
is not independent. Nevertheless, the effort deserves a round of 
applause from consumers and privacy commissioners alike. 
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...In the Office 


Investigating Complaints 


There were no surprises this year. The number of new complaints 
climbed to yet another record total of 1,579—a 13 per cent 
increase. However, investigators closed 1,440 cases during the 
year, almost double last year’s productivity. Of the closed cases, 
590 were well-founded, 757 not well-founded and 104 
discontinued. 


Complaints about time limits and denial of access made up 86 per 
cent of all complaints received. Many institutions have blamed 
their poor track record on staff cutbacks caused by the 
government's drive to reduce expenditures. The result is slower 
service to applicants. 


How Institutions Measured Up 


Here too there are few surprises. Over 85 per cent of the new 
complaints were against virtually the same departments as in 
previous years: Correctional Services (CSC), Revenue Canada, 
Taxation, Employment and Immigration Canada, Canada Post 
Corporation (CPC), Canadian Security Intelligence Service (CSIS), 
Royal Canadian Mounted Police (RCMP), Revenue Canada, 
Customs and Excise, and National Defence. New to this year’s top 
ten are Transport and Health and Welfare Canada. 


Health and Welfare Canada 


New complaints against Health and Welfare climbed to 132 this 
year (90 access, 28 time limits and 14 others) from 40 in 1991-92. 
The vast majority concerned information held by Income Security 
Programs—Canada Pension Plan, Family Allowances and Old 
Age Security—programs that maintain files on virtually every 
Canadian. The department was also the subject of many 
complaints about tardy responses to requests—18 of 37 
completed complaints concerned time limits, all but two of which 
were well-founded. 
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Canada Post Corporation 


The number of new access and time limits complaints against 
Canada Post were similar to last year's—54 and 22 respectively. 
However, the corporation continues to be the target of many 
complaints about its collection, use, disclosure and retention of 
employee records. These 43 privacy rights complaints make up 36 
per cent of Canada Post’s total case load of 119—the highest 
number of any government agency. 


Two years ago there was praise for Canada Post, despite having 
the questionable honour of the office’s most important client. 
Almost 80 per cent of its complaints were not well-founded, many 
related to its administration of the employee attendance and leave 
policy and its modified duties program for employees unable to 
carry out their normal functions due to injury or illness. 


This year more than half of the complaints against CPC focused 
On its inappropriate use of exemptions (half were well-founded), 
and delays in processing (22 of 24 well-founded). 


All but a handful of complaints originated from CPC employees in 
Ontario (particularly in Metro Toronto and southern Ontario) who 
are involved in labour relations disputes. Some CPC labour 
relations officials see an inherent unfairness in allowing employees 
in labour disputes to use the Privacy Act to obtain documents 
germane to their grievance, while there is no parallel right for CPC 
management to obtain access to the unions’ files. 


This view that the Act is a pawn in labour relations disputes has 
made it very difficult to resolve some complaints. An illustration is 
the office’s first case which asks the court to review Canada 
Post's refusal to disclose the identity of a witness who provided 
information in a grievance matter (see In the Courts). 


Other departments 


More than 100 of the 172 complaints investigated against 
Revenue Canada, Taxation were filed by one individual, all related 
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to time limits. Customs too had problems meeting the 30-day 
deadline: 36 of the 44 against that department were well-founded. 


The RCMP is to be commended for its efforts to follow the letter 
and spirit of the access provisions of the Act. Of the 47 time limits, 
denial of access and corrections complaints investigated this year, 
none were well-founded. CSIS, too, responds promptly and 
properly. Only two of 89 complaints were well-founded, but both 
were resolved. 


Still, it is discouraging to have to report that after ten years 


administering the act, many departments still have difficulty 
responding to requests properly and in a timely fashion. 


Origin of Completed Complaints 


Newfoundland 8 
Prince Edward Island 3 
Nova Scotia Pal 
New Brunswick 30 
Quebec 153 
National Capital Region Quebec 13 
National Capital Region Ontario 156 
Ontario 588 
Manitoba 63 
Saskatchewan She) 
Alberta 101 
British Columbia 216 
Northwest Territories 2 
Yukon 19 
Outside Canada 6 
eA A CE SSS 5ST DELIA SE GWU 
TOTAL 1,440 
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Notifying the Commissioner 


Although the Privacy Act generally prevents federal organizations 
from disclosing personal information without the person’s consent, 
there are exceptions. Two of these oblige the organization to 
notify the Privacy Commissioner: a release in the “public interest” 
or one which would clearly benefit the person concerned. There 
were 48 notifications this year. 


The Act requires the head of the organization to determine what is 
in the “public interest’, not the Commissioner. The 
Commissioner's role is to review the proposal and to notify the 
individual concerned if that seems appropriate. The Commissioner 
has no power to prevent a release; however, if he strongly 
disagrees he may initiate his own complaint. The individual also 
has no avenue to block release but does have a right to complain 
to the Commissioner, albeit after the fact. 


Staff examines these notifications, leaving the Commissioner free 
to consider any ensuing complaints. 


Assessing the public interest can be a tough call for department 
heads, as some of this year’s notifications illustrate. 


HIV status disclosed 


Correctional Service Canada (CSC) advised the Commissioner 
that it would disclose the HIV status of a man alleged to have 
sexually assaulted two young girls. The man, on parole at the 
time, had refused the fathers’ request for the results of blood tests 
he took voluntarily when he was arrested. 


since the test results were negative, CSC wanted to assure the 
families that their children had not been exposed to the HIV virus. 
However, the Commissioner cautioned CSC that the negative test 
did not necessarily mean the children’s health was no longer at 
risk. The HIV virus can remain undetected for years after the 
person is exposed. The Commissioner urged CSC to point this out 


48 


to the parents. CSC agreed and the Commissioner advised the 
man of the disclosure. 


Nurse’s name to professional association 


In another HIV-related case, CSC advised it would give the 
Registered Nurses Association of British Columbia the name of a 
nurse who had left an HIV-contaminated syringe on the counter in 
a federal penitentiary. Another nurse then used the syringe to 
draw blood from a second inmate. 


CSC’s board of investigation recommended reporting the incident 
to the association. Nurses are obliged to report any breaches of 
their code of conduct to their association but the nurse’s union 
had advised her to refuse. CSC considered it in the public interest 
to ensure professionals comply with their code of conduct and 
advised the association. The Commissioner wrote to the woman to 
ensure that she understood the government's obligations and her 
rights under the Privacy Act. 


Team member’s passport details to Olympic organizers 


A last minute opportunity for the Canadian women’s fencing team 
to compete in the Barcelona Olympics prompted an urgent call to 
External Affairs Canada for passport information on a team 
member. 


The team had not qualified in the top 12 during preliminary 
competitions and members had dispersed. But when two 
qualifying countries failed to field complete teams, the Canadian 
women were invited. Organizers scrambled to re-assemble the 
team and to provide passport information immediately to Olympic 
officials for security and identification. When organizers could not 
reach one of the members, they asked External to provide the 
woman’s passport number and expiry date. 
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External concluded that there was a public interest in having the 
team compete and a personal benefit to the team member. The 
department advised the Commissioner it would release the 
information. She was reached 12 hours later. 


Electoral lists to political parties 


A 1992 privacy compliance review of Elections Canada revealed 
that electoral lists were routinely being disclosed to political parties 
and candidates in the “public interest” without notifying the 
Commissioner. As a result of the review, the Commissioner 
received his first formal disclosure notice in January 1993. 


The lists are assembled from door-to-door enumeration conducted 
during an election campaign. They contain the last and first 
names, sex and address of each eligible voter in the riding and 
are available in paper or electronic form. Political parties and 
candidates use them for promotional mailings, door-to-door 
canvassing and to solicit contributions. The current lists are 
particularly valuable since voters were enumerated recently for the 
Constitutional referendum. 


Elections Canada receives many requests for the lists but 
provides them only to political requesters in the interest of 
candidates reaching constituents during an election campaign. The 
Commissioner is satisfied as long as the lists are used only for 
election purposes. 


Nepotism allegations prompt release of personal details 


A competition for customs inspectors in Winnipeg and Emerson, 
Manitoba led to allegations of favouritism in the Winnipeg Free 
Press. The Public Service Commission (PSC), which hires all 
federal public servants, advised the Commissioner that it had 
investigated the allegations and intended to release its report. 
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The PSC received more than 1,000 applications for the job 
openings at Revenue Canada, Customs and Excise. After an initial 
screening, customs Officials interviewed 279 candidates who had 
passed the written test. The 20 qualified candidates were ranked 
in order of merit and 11 were offered positions. 


Several unsuccessful candidates complained that at least three of 
those hired were relatives of Customs superintendents. Local 
media reported the allegations and other complaints surfaced—25 
in all—including one from the Customs employees’ union. 


Given the seriousness of the allegations—and the PSC’s mandate 
to uphold the merit principle in public service hiring—the PSC 
concluded that there was a clear public interest in a full accounting 
of the process. The report contained the names of all qualified 
candidates who were related to Customs employees, the position 
titles (but not the names) of the employees to whom they are 
related, and brief general summaries of the employment 
experience of a number of the applicants. 


Unfortunately, the Privacy Commissioner was not notified until the 
day after the report was released to the newspaper, giving him no 
opportunity to alert the individuals to the probable publicity. PSC 
acknowledged the error but felt pressured to deal with the 
continuing media inquiries. The Commissioner decided to write to 
all those involved to explain the process and their rights under the 
Privacy Act. 


Petro Can shareholders not disclosed 


Supply and Services Canada (SSC) advised the Privacy 
Commissioner that the Information Commissioner had 
recommended it release the names and last known addresses of 
shareholders of Petro Canada Enterprises Inc. to an “investigative 
accountant.” 


Si 


The department denied the accountant’s Access to Information 
request because the information was personal and therefore 
exempt. The accountant complained to the Information 
Commissioner, arguing that it would benefit the shareholders if he 
could use the SSC lists to find them and—for a fee—obtain the 
moneys owing. 


SSC holds the lists because the company was dissolved in 1983 
and the value of the unredeemed shares ($120.14 each) was paid 
into general government revenues. Registered owners may claim 
the money from SSC. 


Apparently SSC had written to each shareholder at the wind-up of 
the company explaining the arrangement for cashing the shares. It 
also placed advertisements in major Canadian and foreign 
newspapers. Approximately 80 per cent of the shares have been 
redeemed and the department continues to receive claims from 
individuals on its lists. Following the complaint, the department 
mailed another reminder to shareholders. It argued that any 
shareholder who is unsure how to obtain the money need only 
contact Petro Canada or any stock broker. 


There is a public interest in ensuring that the government makes 
reasonable efforts to locate those for whom it holds money. 
However, the Privacy Commissioner had reservations. He 
questioned whether that interest was best served by disclosing the 
information, without shareholders’ consent, to a third party who 
intends charging a finder’s fee of 15 to 40 per cent of the shares’ 
face value. The disclosure seemed to served the accountant’s 
interests more than the shareholders’. 


Nor would the disclosure guarantee that all shareholders’ interests 
would be served. The Commissioner doubted that it would make 
economic sense for the accountant to attempt to find at least half 
of the shareholders who hold three or fewer shares. As well, 60 
per cent of all those on the list live outside Canada. 
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A second concern was how SSC would protect shareholders from 
subsequent use or sale of the lists. Once released, there is no 
legal means for the government to prevent third parties from 
duplicating, selling or otherwise using the information. 


Finally, the Commissioner wondered how the accountant expected 
to find the shareholders using the same addresses as SSC. If 
there was a way, he encouraged SSC to use it and save the 
shareholders the third party’s fees. Both Commissioners agreed 
that SSC needed to be more aggressive in communicating with 
shareholders—however the Privacy Commissioner was 
unconvinced that disclosure to a third party was the best remedy. 


Although the accountant did not get the lists he wanted, his 
access complaint prompted the department to write again to all 
shareholders and to consider other ways of reaching those who 
do not respond. 
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Inquiries 


Inquiries also increased again this year—by 10 per cent to 5,183. 
Of these, 4,865 were telephone calls, 274 letters and 44 personal 
visits. 


Almost 55 per cent dealt with individuals’ rights under the Act but 
about 20 per cent concerned privacy matters over which the 
Privacy Commissioner has no jurisdiction—other public sector 
organizations or private businesses. The remainder had been 
mis-directed or had nothing to do with privacy. Although many of 
the questions are outside the office’s mandate, inquiries officers 
redirect callers to the appropriate organization or department. 


Several callers were concerned about postal employees recording 
their identification card numbers when they received parcels and 
registered mail. The office reviewed Canada Post’s procedure 
which requires anyone picking up parcels or registered mail to 
produce acceptable identification, and the postal employee to 
record the details in a ledger. 


The Commissioner agreed that Canada Post must check 
identification to ensure that the person claiming the parcel is the 
intended recipient. The information is logged to provide a trail in 
case valuable goods or documents go astray. Privacy staff also 
confirmed that delivery registers are kept in an area not accessible 
to the public. 


Inquiries officers continue dealing with many calls concerning the 
collection, use and disclosure of personal information by financial 
institutions. Since the banks are not subject to the Privacy Act, 
and the Office of the Superintendent of Financial Institutions does 
not deal with complaints about information practices, privacy staff 
must refer callers back to the financial institution—each of which 
has its own policy on management and use of personal 
information. 


Inquiries officers often must explain that the Act deals with just 
one facet of privacy. For example, a man returning recently from 
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an overseas assignment, complained to the Commissioner about 
customs officials’ rudeness and of their searching his personal 
files and belongings. He wanted to know his rights under the 
Privacy Act. Privacy staff explained that the Customs Act 
authorizes customs officers to examine goods and mail, and their 
rudeness is not covered by the Privacy Act. 


Sometimes callers ask that their complaint be handled informally. 
An employee of a company participating in a work sharing 
program with Employment and Immigration Canada (EIC) was 
concerned that EIC sent documentation to the employees through 
the employer. 


Although the company needed to examine employees’ benefit 
statements to make the proper wage adjustments, the caller did 
not think it needed to see the employees’ Telephone Access 
Code (TAC). This is a personal identification number which gives 
Ul recipients access to information about their benefits over the 
telephone. EIC looked into the problem and agreed to remove the 
access code from the documents. It advised employees to change 
their TAC number. 


Three callers asked whether a Moneymart, a video store and a 
large appliance store were allowed to take identification pictures of 
them. There is no legislation covering this situation. Is picture 
taking a new fad? 


Inquiries about the SIN continue—549 this year. The Office’s 
advice to anyone not wanting to provide their SIN to private 
businesses, landlords, or organizations not subject to any 
legislation covering the SIN, is to ask: 


¢ Do you need my SIN to comply with a legal statute or 
regulation? 

Why do you need it and how will you use it? 

Will you keep it confidential? 

What are the consequences if | refuse? 

Would you accept another ID? 
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Some Cases 


Job competition notes accessible 


A complaint against the Department of Justice established an 
important precedent for access to handwritten notes taken by 
board members during job competitions. 


A man asked the department for copies of all material gathered 
during his job interview. He complained to the Commissioner when 
Justice could not find the interviewers’ notes. 


The investigator found that all the selection board members took 
handwritten notes to help rate the candidates during the 
interviews. The notes taken by three board members were 
destroyed once the hiring process was completed. The fourth 
member (a Staffing officer) recalls including her notes with the 
documents transferred to personnel when she left the department 
shortly after the interviews. However, a search of the department's 
Staffing files found nothing. The department assumed the notes 
were inadvertently lost or destroyed. 


While the Commissioner was prepared to concede that all 
employees occasionally make personal notes which cannot be 
considered “under the control” of their department, he was not 
persuaded that this was such a case. In his view, selection board 
members’ notes are made to choose a candidate—an 
administrative purpose—and should become part of the staffing 
file. This means they are accessible under the Privacy Act. 


After extensive consultations, Justice finally accepted the 
Commissioner's position. The department was unable to establish 
the exact content of the notes made about the complainant. 
However, it admitted that since the selection board considered the 
notes in reaching its decision, they had been used for an 
administrative purpose and should have been retained and made 
available to the complainant. Since they had not been kept, the 
Commissioner considered the complaint well-founded. 


o/ 


As a result of this investigation, Justice assured the Commissioner 
that it would require future selection boards to retain “notes made 
by members and used in the decision-making process.” The 
handwritten notes will be given to the personnel representative 
and become part of the final board report (unless they are 
incorporated verbatim). The Commissioner agreed with the 
department’s observations that the ramifications of the case were 
important enough to mitigate the delay. 


Disciplinary notice not for union 


An employee of Employment and Immigration Canada (EIC) 
complained to the Commissioner that his manager improperly 
disclosed disciplinary information about him to another employee 
during the October 1991 strike of the Public Service Alliance of 
Canada (PSAC). 


The investigation revealed that the complainant was a “designated 
employee’, meaning he was required to work during the strike. 
However, one morning he failed to report for work and was seen 
later on the picket line. His manager wrote a letter reprimanding 
him for being absent without authorized leave, and attempted to 
give it to the complainant. He refused to accept it. 


After advising him to report to work immediately (and the financial 
implications of refusing), the manager put the letter on the 
complainant’s desk. He also gave a copy to the PSAC union strike 
coordinator, who was the complainant’s local steward. 


The Commissioner agreed that an employer has the right to tell 
the union official that a member is engaged in an unlawful strike 
but it did not have the right to give her a copy of the written 
reprimand, showing what disciplinary action would be taken. The 
Commissioner considered the complaint well-founded. 
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No medical details during reference checks 


Another EIC employee complained to the Commissioner that the 
department improperly collected confidential and inaccurate 
medical information about her during a reference check with a 
supervisor, then used it to eliminate her from the list of qualified 
candidates. 


The investigation confirmed that during a job competition in one of 
its employment centres, EIC staff conducted telephone reference 
checks with qualifying candidates’ most recent supervisor. Asked if 
the complainant's attendance and punctuality were satisfactory 
during the past year, her supervisor provided specific medical 
details which were then recorded on the file. 


Collecting information about illnesses or injuries during reference 
checks poses potentially serious privacy problems. It can harm the 
individuals by revealing gratuitous details about the person’s 
health or life. The Commissioner was concerned about the 
accuracy of any medical information collected during the process, 
as well as the validity of any conclusions that staff might draw 
based on such medical data. 


The Privacy Act prohibits collecting personal information unless it 
“relates directly to an operating program or activity” of the 
department. EIC conducts literally hundreds of staffing actions 
every year so it is inevitable that it will occasionally be offered 
unsolicited medical information during reference checks. 
Nevertheless, the Commissioner considers it the department's 
responsibility to ensure that it does not collect more personal 
details than it needs simply to assess a candidate’s record for 
attendance and punctuality. 


The Commissioner concluded that the medical information was not 
required for the staffing action and that the complaint was 
well-founded. However, he dismissed a second complaint that EIC 
had misused the information when it became apparent that it was 
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the complainant’s attendance record (which was relevant) that 
made her unsuitable for the job. 


EIC removed all the supervisor's references to her illness from the 
files. In addition, it agreed to publish guidelines to remind 
managers about the proper way to conduct reference checks in 
keeping with both the Privacy Act and the Canadian Human 
Rights Act. The Commissioner considered the matter resolved. 


Need court order for disclosure 


An employee of Correctional Service Canada (CSC) complained to 
the Commissioner that her director disclosed to a third party a 
copy of a security investigation report containing personal 
information about her. 


The director confirmed that he had given a copy of the woman’s 
report to the director of an after-care agency under contract to 
CSC. He had provided the report at the agency’s request because 
the complainant had filed a lawsuit against the organization. 


The Privacy Commissioner concluded that none of the disclosure 
provisions of the Privacy Act justified this release. The Act allows 
personal information to be released in response to a subpoena or 
court order but the outside agency had obtained neither. The 
Commissioner concluded that the disclosure was unwarranted and 
considered the complaint well-founded. 


Legal guardian must consent for minor 

A man complained to the Commissioner that External Affairs 
denied him access to his son’s passport records. The father felt 
that since his son was a minor, he was entitled to see the records. 
The Commissioner was satisfied that the passport information was 


personal information about the son. The Act allows personal 
information to be disclosed only to the subject of the information 
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unless he or she consents to release to a third party (there are 
some specific exceptions). Since the son is a minor, the Privacy 
Regulations require the consent of the individual’s legal 
guardian—in this case, the complainant’s former wife. 


The Commissioner believed that External Affairs had acted 
properly in refusing the complainant’s request and considered the 
complaint not well-founded. 


SIN optional for job-seekers 


A man’s complaint that Employment and Immigration Canada 
(EIC) misused his social insurance number (SIN) has led to a 
change in the way EIC registers clients seeking employment. 


The complainant refused to provide his SIN when registering for 

summer employment and wanted to know why it was necessary. 
He alleged that his question was referred to a manager who then 
retrieved the man’s SIN from departmental files before talking to 

him. 


EIC claimed that it is reasonable for a CEC manager, before 
returning a client’s phone call, to use the client’s SIN to retrieve 
the file and thus be better prepared to respond to the client. The 
Commissioner was satisfied with the explanation and found the 
complaint to be without merit. 


However, EIC officials were asked why clients must provide the 
SIN when simply registering for employment. They assured the 
Commissioner that the intent is simply to provide the broadest 
range of services EIC has to offer its clients. The SIN is the only 
practical means for identifying and referring clients with particular 
skills to suitable job openings. 


Nevertheless, EIC did agree to dispense with collecting the SIN 
when the client objects. However, staff will caution those clients 
that not having their SIN will limit the services EIC can provide 


61 


and could mean lost job referrals. The choice of providing the SIN 
will rest with the client. 


HIV poster display ‘“‘careless’”’ 


The Privacy Commissioner received a complaint from the B.C. 
AIDS Network that the RCMP had posted photographs and 
descriptive details about five HIV-positive individuals on a bulletin 
board in the local detachment. Someone had seen the information 
and told one of the individuals who complained to a local AIDS 
support group. 


The Commissioner investigated to determine whether the RCMP 
should have collected the information that the individuals were 
HIV-positive, and to assess how the Force was using it and 
whether the disclosure was proper. 


The investigation established that the photographs and details 
were collected from the detachment’s own operational files. Police 
files identified all five individuals as known repeat offenders with a 
propensity to violence. They were considered to pose a threat to 
police and guards and all had volunteered that they were carriers 
of the HIV virus. 


Although the individuals were well Known to the detachment’s 
full-time guards, staff suggested posting the information in the 
guards’ office where 10 casual guards (who replace full-time staff 
who are on leave or sick) would see it. 


The investigator found that prisoners and the public do not enter 
the guards’ office. In fact, even police officers do not normally 
have access. However, the office is frequently left unoccupied 
when guards are busy elsewhere in the cell area. 


lt was evident that the photographs and documents were too small 


to be discernible from the open counter at the front of the office, 
or even from the doorway. Given that the bulletin board is 


62 


mounted on the same wall as the door and counter, someone 
would have had to enter the office and approach it to read the 
details. The investigator was unable to determine who had seen 
the material. 


The information has since been removed from the bulletin board 
and placed in one of the desks. The RCMP is drafting a policy to 
control the display of identifying information about detainees who 
are HIV-positive or who have developed AIDS. 


The Commissioner considered it reasonable for the RCMP to 
inform guards about individuals who pose a risk to employees and 
other prisoners. He concluded that the display did not breach the 
Act. However, while the Commissioner remains concerned about 
Organizations assembling inventories of people identified as 
HIV-positive, he appreciates the quick action of both AIDS 
organizations, and the RCMP’s immediate response. 


Doing the bureaucratic shuffle 


The man looking for information about his participation in EIC job 
training programs in 1975 complained to the Commissioner when 
all he got was a run-around. 


First he went to his local Canada Employment Centre where he 
was told that the department did not keep the information as far 
back as 1975. He consulted Info Source (the directory of 
government information holdings) which confirmed that the training 
files were indeed kept for 25 years. Reassured he went to EIC’s 

_ Toronto regional office and tried once again. 


The regional office referred him back to his local CEC who 
repeated that the information did not exist. This time his request 
was referred to the National Archives. 


During the shuffle, the complainant was given several inconsistent 
explanations. He was told the material was kept for only two 
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years, then seven years. The Info Source listing describes the 
retention period of one bank as indefinite; the second as two 
years for paper and 25 years for machine readable records. 


The first thing the investigator needed to establish was just how 
long EIC kept the information in the two banks. Officials explained 
that the information is indeed kept for two years in individual 
Canada Employment centres, then it is transferred to a 
departmental archive where it is kept for a further five years. The 
information is then destroyed. Only statistical and program 
evaluation material (not personal information) is transferred to 
computer tapes and kept for 25 years. 


The Commissioner concluded that the information had not been 
improperly destroyed and that complaint was not well-founded. 
However, he was concerned about the confusion, the repeated 
re-routing of the complainant's request and the inconsistent 
explanations about why the information did not exist. He asked 
EIC to clarify its explanation of the retention periods in /nfo 
Source—the tool on which the public depends to gain access to 
their records. 


Improper Collection of Medical Information 


An employee of the St. Lawrence S3away Authority (SLSA) 
complained to the Commissioner when he was refused pay for 
two days sick leave because he would not disclose the nature of 
his illness to his supervisor. 


SLSA policy required all employees claiming sick leave to supply 
the medical details on the “Application for Leave” form. The 
information was then reviewed by the employee’s immediate 
supervisor who determined whether the condition warranted 
payment of sick leave. 


SLSA staff argued that supervisors must collect and assess the 
information because occupational health and safety rules require 
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SLSA to ensure returning employees will not endanger themselves 
or colleagues. They also argued that collecting the medical details 
kept employees honest and was an important factor in controlling 
absenteeism and reducing costs. 


The Privacy Commissioner recognizes that employers have a right 
to satisfy themselves that an employee’s absence is justified, and 
there may be occasions when it will need to collect medical 
information from employees before endorsing sick leave requests. 
However, he does not agree with unqualified personnel collecting 
and assessing medical information. The Commissioner considered 
the complaint well-founded since the right to collect medical details 
to assess an employee’s fitness should be reserved only for a 
qualified medical practitioner. 


SLSA officials responded by changing their sick leave collection 

procedures, in place since the 1960s. The nature of illness is no 
longer disclosed to supervisors. When needed, it is collected and 
reviewed only by qualified medical practitioners. 


Locator information unnecessary 


An inmate asked for access to his Offender Grievance Files at 
Correctional Services Canada (CSC). He complained to the 
Commissioner when CSC refused to process the request, claiming 
he had not provided them with all the locator information needed 
to find the files. 


The investigator found that every CSC institution keeps either a 
computer or manual log of all grievances submitted by inmates in 
their institution. Any CSC institution could easily identify and locate 
an inmate’s grievance file in that institution just by using the 
inmate’s name. The additional locator information was not 
necessary. CSC admitted that it could retrieve the file using the 
name and agreed to change its requirements for access to this 
information. 
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The complaint was well-founded. 
Public interest release prompts complaint 


Last year the Office reported receiving a complaint against the 
Privy Council Office (PCO) following its disclosure of personal 
information about two members to their professional body. 


The case illustrates the limitations on the Commissioner’s powers 
and the individual’s rights in these ‘public interest’ disclosures. It 
also demonstrates why staff examine the disclosure notices: the 
Commissioner must not have pre-judged the release and be 
prevented from ruling on a subsequent complaint. 


The material was produced during a federal commission of inquiry. 
The commission report recommended the professional body 
review its members’ conduct and PCO (the custodian) agreed to 
the body’s subsequent request for the records. PCO advised the 
Commissioner, arguing there was a public interest in the body 
maintaining its professional standards. 


The Office recommended notifying the two members (and their 
clients whose information would also be disclosed as evidence) 
and PCO agreed. One of the two then complained to the 
Commissioner. 


The Commissioner reviewed PCO’s procedure, the inquiry 
commission’s recommendation, the material released and the 
powers of the professional body to compel evidence and conduct 
investigations. 


He concluded that the disclosure did not violate the Privacy Act. 
He also pointed out that the professional body’s powers were 
sufficient to compel PCO to produce the material under another 
provision of the Act. 
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Access to consent of “‘other parent” 


An estranged husband asked External Affairs’ passport office to 
provide him with a copy of his declaration, signature and consent 
contained in his wife’s application to include their children on her 
passport. 


The passport office replied that since the application belonged to 
his wife, he would need her authorization to obtain a copy. 


The investigator examined the material and disagreed, pointing out 
that the information belonged to the husband since it refers to the 
“other parent’, not the parent completing the passport application. 
The passport office was unconvinced and very reluctant. After 
much debate, it finally released the disputed information. The 
Commissioner considered the complaint well-founded and 
resolved. 


Parole Board fine tunes process 


The National Parole Board often has to consult other organizations 
such as provincial government agencies or police forces before 
completing an access request. In one case, the Board wrote to 
several organizations asking for consent to release information 
they had provided about the applicant. 


All but one responded in time for the board to process the request 
within the required 60 days. However, the PEI Crown Prosecutor 
did not respond to several letters. After many months, the board 
finally reached him and he agreed to release the information. 


Given the time it took to get a response (and the well-founded 
complaint to the Commissioner), NPB decided to change its 
consultation process. Consultation letters now state that if the 
board does not receive a reply by a specific date, it will process 
the information in accordance with the federal Privacy Act. The 
onus has now shifted; an organization must respond quickly if it 
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wants to refuse to disclose information. And applicants are not 
kept waiting needlessly for months. 


Questionnaires need own bank 


Several Employment and Immigration Canada (EIC) employees 
complained through their union that a questionnaire collecting 
personal information for the department’s Human Resource 
Inventory Program (HRPIP) violated their rights under the Privacy 
Act. 


They complained that they had not been told the purpose for the 
collection. They also alleged that managers had ordered them to 
complete the supposedly voluntary questionnaire, requiring them 
to consent to all subsequent uses and disclosures of the 
information. They argued that this was a de facto avoidance of the 
use and disclosure provisions of the Privacy Act. Finally, they 
complained that the information being collected was not described 
in Info Source, as required by the Privacy Act. 


EIC was sensitive to the employees’ privacy concerns. Although it 
had tried to ensure full compliance with the Privacy Act in carrying 
out the project, some details had to be addressed. 


The investigator found no evidence to substantiate the claim that 
employees had been ordered to complete the questionnaire. 
Although the language was not entirely clear, on second reading it 
was possible to determine that completing it was voluntary. 
However, EIC officials agreed to clarify the opening statement. 


It was true that the collected information was not described in Info 
Source. EIC officials explained that all the separate pieces of 
information were described in the various standard employee 
banks, so it was unnecessary to develop a new bank. The 
Commissioner disagreed, viewing this as a distinct bank of 
personal information collected for a specific purpose. 
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Since many departments have similar programs (and there is no 
standard employee bank for this information), the Commissioner 
decided to accept EIC’s explanation, close the complaint file, and 
work with Treasury Board to develop a new government-wide 
standard bank for these records. 


Inmates receive each other’s records 


Two inmates in a federal penitentiary complained that the personal 
information of each inmate had been improperly disclosed to the 
other. Both had requested their own records but when they were 
delivered, each envelope was found to contain the others’ files, 
despite being properly addressed. 


Staff at the institution confirmed that the incident happened 
substantially as reported. However, the files had arrived at the 
institution in sealed envelopes so the investigation focused on the 
privacy coordinator’s office in headquarters where the envelopes 
had originated. 


The investigator confirmed that controls are in place to prevent 
such incidents. However, the sheer volume of files handled by 
CSC headquarters, combined with shortages of trained staff to 
cope with that volume, made it almost inevitable that a mistake 
would happen. The Commissioner concluded that the two 
complaints were well-founded but made no recommendation that 
CSC institute further controls. The mix-up was probably 
attributable to human error. 
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...In the Office 


Assessing Compliance 


This has been a year of change and adjustment for the 
Compliance Directorate. In addition to a full workload 

(nine compliance audits, two special investigations, 12 follow-up 
audits and a study of information technology from a privacy 
perspective), the unit became the focal point for an Office-wide 
operational renewal. 


The directorate was originally envisaged as an audit unit which 
would conduct systematic independent reviews of the 160-odd 
federal institutions subject to the Privacy Act. The workload this 
generated, combined with the need to examine emerging privacy 
issues, have proved simply beyond the limited resources available. 
However, the Office is unwilling to abandon this goal and simply 
react to complaints. 


To meet this challenge, the operations and structure of the 
directorate have been redesigned. The result is a fresh approach 
to audit selection (who we audit), audit scoping (what we look at) 
and methodology (how we investigate). Investigators are shifting 
emphasis away from physical security and information bank 
descriptions. They now give more attention to determining whether 
agencies are collecting only personal information that meets 
operational requirements, and properly using, sharing and 
disclosing information. These changes should enhance our ability 
to investigate privacy issues and reinforce our ability to inform 
Parliament on privacy matters. 


Special Investigations 


This year the Compliance Directorate completed two special 
investigations of potential violations of the Privacy Act. 


Computer stolen from Veterans Affairs 


Last year’s annual report reported the theft of a portable computer 
from an office of Veterans Affairs (VA). Again this year VA 
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reported a computer containing personal information had been 
stolen from an employee’s home. The employee had the authority 
to use the computer at home and had taken reasonable measures 
to secure it and the information it contained. Since our last report, 
VA has improved security measures to protect personal 
information stored in portable computers. As a result, the 
Commissioner decided not to notify the individuals concerned. 


Personal computer use has increased dramatically in the public 
sector during the past decade and not just at the office. With the 
advent of work-at-home programs (telework) and light, powerful 
portables, personal information is leaving the workplace. However, 
our review of departmental practices this year reveals that 
departments are unable to account for the number, location and 
use of their personal computers. 


It is passing curious that this latest theft at Veterans Affairs is only 
the second ever reported to this office. Have other computers 
gone astray but departments either do not have the proper 
controls in place to identify the losses or to report the incidents to 
our office? 


Personal information found in surplus file cabinets 


The office received a call that used filing cabinets being sold at a 
warehouse surplus store still contained personal documents. Only 
a remarkable coincidence led to the office hearing about the 
incident—the caller once worked for the Privacy Commissioner’s 
office. Investigators retrieved the documents and confirmed that 
they had originated in two federal departments. 


The first group of documents included more than a dozen 
Transport Canada files, one of which was an employee travel 
expense claim file (the rest were not personal). This file contained 
substantial detail from the employee’s transfer including utility bills, 
mortgage documents and even a cancelled cheque with his bank 
account number. 
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The second group originated with Health and Welfare Canada and 
was far more sensitive. It contained approximately 370 index 
cards documenting the lab tests undergone by each individual (but 
not the results). Investigators immediately notified the two 
departments and returned the documents. 


Both departments investigated and reported back that they have 
procedures for ensuring that all documents are removed from any 
equipment declared surplus. Both acknowledged that they had 
been lax and began briefing staff and improving physical security. 
Although this office has no evidence to suggest that personal 
information is regularly being left in equipment declared surplus, 
the company reported it frequently finds documents in old 
cabinets. 


The incident, while embarrassing for the departments involved, 
should remind all federal institutions to review their procedures 
and communicate them to staff. 


Audits of Institutions 


The Directorate completed audits of nine institutions this year: the 
Canadian International Trade Tribunal, Elections Canada, the 
National Library of Canada, the Canadian Transportation Accident 
Investigation and Safety Board, National Research Council 
Canada, Veterans Affairs Canada, Bureau of Pensions Advocates 
Canada, the Canadian Pension Commission and Veterans Appeal 
Board Canada. 


The audit of Labour Canada, begun in 1992, is nearing 
completion. In addition, Indian and Northern Affairs Canada and 
the Bank of Canada are currently conducting their own internal 
privacy audits. Privacy staff will review the results of these audits 
in the coming year. 
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Common themes 


One summary observation from this year’s audits is the improved 
information management practices and better handling of personal 
information. This is particularly true in the area of information 
security and data maintenance. Despite this, audits continue to 
reveal a general lack of understanding of the Privacy Act and the 
role of this Office, particularly at the operational level. 


We found several broad areas of concern during our audits. 
Contracting out 


Budget cuts and staffing freezes are causing more federal 
government institutions to contract to the private sector work 
involving personal information. Prime targets are Employee 
Assistance Programs, management consulting, computer 
programming and, in some cases, the day-to-day functioning of 
entire programs. Our audits continue to reveal that many contracts 
do not require contractors to comply with the Privacy Act and its 
code of fair information practices. Where investigators did find 
provisions about handling personal information in contracts, they 
were so general as to render them virtually ineffective for privacy 
protection. 


Retention and disposal 


Investigators continue to find instances of institutions not applying 
retention and disposal schedules and even of not developing 
these schedules. Retaining personal information beyond its 
approved period could harm an individual should staff make 
decisions about the person on the basis of invalid or out-of-date 
information. 
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Info Source descriptions 


In six of the nine institutions audited, investigators found 
information holdings that were not described in the Info Source 
directory or whose descriptions were incomplete or inaccurate. 
Since the right of access to personal information is one of the 
cornerstones of the Act, accurate descriptions of all personal 
information holdings are critical. 


Access to personnel files 


In most institutions audited, managers and supervisors can get 
access to the complete personnel files of their employees. This 
provides them access to sensitive personal information beyond 
their operational needs. This could include information such as 
divorce documents, support payments and designation of 
beneficiaries. 


Regular readers of these reports will find many of these findings 
depressingly familiar; evidence the need to educate public 
servants. 


Some Specific Observations 


Office of the Chief Electoral Officer 


This audit identified two key findings concerning the release of 
personal information from electoral lists. In the first case, 
investigators found that information was frequently being released 
under section 8(2)(m) of the Privacy Act to third parties (see 
Notifying the Commissioner). These disclosures were mainly to 
individuals to help confirm that they met residency requirements 
for pension or other legal claims. 


However, the electoral office had never notified the Privacy 
Commissioner of these releases as the Act requires. When 
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investigators pointed this out, electoral staff agreed to notify the 
Commissioner in future. 


The second finding concerned the electoral office’s sharing of 
information from the federal electors list with municipalities to help 
them prepare for local elections. This disclosure did not appear to 
be a consistent use and electoral office staff agreed to either stop 
the practice or conclude formal agreements with individual 
municipalities to share this information and describe the new use 
in Info Source. 


Veterans Affairs Canada 


Veterans Affairs is an excellent example of an institution that 
complies with the Privacy Act and the code of fair information 
practices. Their commitment to training staff in privacy matters is 
encouraging and greatly facilitates proper management of 
personal information in the department. 


A contract with Atlantic Blue Cross covering the administration of 
the Treatment Accounts Processing System, reviewed during the 
audit, could serve as a model for other departments that 
administer similar programs. Investigators also noted that privacy 
concerns are automatically considered in the design of the 
department’s EDP systems. 


One concern meriting specific mention concerns disposal of 
documents in the paper recycling bins. Like most departments, 
Veterans Affairs has an active paper recycling program. Despite 
instructions to the contrary, periodic inspections by VA security 
staff (and a sampling by the audit team) revealed personal 
information in the bins. 
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Following Up 


To support this year’s retrospective, investigators reviewed the 
outcome of several privacy compliance audits and complaints 
investigations conducted between 1984 and December 1989. 


In order to determine whether departments had acted on the 
Office’s recommendations, staff selected 20 audits and 116 
recommendations stemming from complaint investigations. 


Twelve institutions were examined in the past year: Agriculture 
Canada, Canada Post Corporation, Correctional Services Canada, 
Environment Canada, Fisheries and Oceans, Health and Welfare 
Canada, International Development Research Centre, Solicitor 
General Canada (Ministry Secretariat), Pension Appeals Board, 
Public Service Staff Relations Board, Supply and Services Canada 
and Transport Canada. 


Investigators found about 74 per cent of all audit recommendations 
had been implemented, 16 per cent were partially completed or 
underway and the remaining 10 per cent had not been addressed. 


Summary Observations 


Overall, departments have responded positively to the Office’s 
recommendations. Many recommendations have led to 
departments developing new policies and procedures at the 
corporate level. Unfortunately, this has not led to similar 
adjustments in the programs or regions. The reverse is also true; 
field offices have changed their practices to reflect the audit 
findings despite the absence of a change in corporate policy. 


In general, investigators observed an overall improvement in 
attitude towards privacy. Government staff (particularly at the 
working level) are more aware of privacy concerns yet there is still 
minimal knowledge of the Act and its impact on federal 
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government operations. There is also little understanding of the 
role and functions of this Office. 


These follow-ups also identified the difficulty experienced by some 
institutions in responding to recommendations involving the 
retention and disposal of personal information. Employee and 
client personal information are sometimes retained well beyond 
approved retention schedules and some schedules have not been 
approved at all. Departments cited budget constraints and delays 
at National Archives Canada as the cause. 


Highlights by Institution 


Agriculture Canada has acted on about half of the 
recommendations made in the Office’s 1988 audit. Agriculture’s 
treatment of personnel files is uneven; regional supervisors in 
some locations now have access only to relevant employee 
personal documents as recommended. However, in other 
locations, they see the entire employee record. Investigators found 
that 40 per cent of personnel files examined contained outdated 
employee performance appraisals and one general personnel file 
included a complete human rights investigation report containing 
very sensitive personal information. 


Canada Post Corporation has acted on many of the 
recommendations from the 1988 compliance audit and follow-up 
from individual complaints. Investigators noted improved 
information bank descriptions, data security and policy 
development. However, they also found that regions were 
inconsistent in implementing some of the changes. For example, 
supervisors’ access to employee files has been restricted at 
headquarters by splitting the files, removing third party information 
and fingerprints. Unfortunately, this has not been completed in 
most regional offices visited. 


Correctional Service Canada has addressed many of the audit 
recommendations concerning access to personal information and 
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improved listings in /nfo Source. In addition, investigators reviewed 
several complaint investigations concerning disclosure of inmate 
personal information and confirmed that the recommended 
controls are now in place. 


Environment Canada has not responded adequately to many of 
the Privacy Commissioner’s recommendations. In fact, the 
Commissioner has not received a formal response to the 1988 
audit report. Staff blamed centralization, decentralization and staff 
changes in the ATIP section for not completing the 
recommendations. The review found that some locations acted 
independently to improve protection of personal information and 
staff awareness. However, the corporate response has been 
disappointing. 


Fisheries and Oceans was the first institution audited by the 
Office in 1985, serving as a test run for new auditors. Fisheries 
has complied with recommendations to stop collecting the social 
insurance number on fishing applications and cease publishing the 
Fishing Licence Directory containing personal information. 
However, the department continues maintaining indefinitely the 
personal records in the Atlantic Commercial Fishing Licence 
Database (PU-010) formerly Commercial Fishermen’s and Vessel 
Registration bank. 


Health and Welfare Canada has amended most of their personal 
information bank descriptions as recommended in the 1990 audit. 
The department has had less success disposing of outdated 
personal information at national headquarters and in one of the 
regions surveyed. 


International Development Research Centre has dealt with 
most of the audit recommendations and is improving its protection 
of personal information while negotiating with National Archives 
Canada for an approved retention and disposal schedule. 
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Solicitor General Canada (SGC) has acted on most of the eight 
recommendations for improvement. Its request for an approved 
retention and disposal schedule from National Archives Canada is 
still outstanding. Although SGC has not purged staff personal 
records as recommended, its new automated Resource 
Management Information System (RMIS) will address this 
concern. 


Supply and Services Canada responded positively to most of the 
concerns identified, restricting Supervisors’ access to employee 
personal records and registering all its personal information 
holdings in Info Source. 


Transport Canada has responded to about 70 per cent of the 
recommendations made in the 1988 audit. Transport must be 
commended for its disposal of duplicate records containing highly 
sensitive personal information. However, the department has not 
yet amended the bank descriptions of its Aviation Licensing 
Database bank and Vehicle, Ship, Boat and Aircraft Accident 
bank. In addition, medical examination reports remain part of the 
Aviation Licensing Database rather than in the medical files, as 
recommended. 


Both the Pension Appeals Board and Public Service Staff 
Relations Board have dealt with all our audit recommendations, 
resulting in proper identification of personal information holdings, 
better protection of information and an increased privacy 
awareness. 
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It's 1993 — Do you know where 
your information is? 


Governments have always been massive collectors of personal 
data—but the growth of social programs and demand for 
government services, coupled with governments’ vast technical 
ability to collect, manipulate and share information, make it vital 
for Canadians to know what governments know about them. 


What personal data does the federal government hold? Although 
far from complete, most readers will recognize themselves 
somewhere in the following. 


A key group of departments holds financial information on most 
Canadians. Revenue Canada, Taxation collects individual tax 
returns (approximately 17.5 million tax forms) which can contain 
everything from bank account numbers and charitable 
contributions to alimony payments and physical disabilities. Health 
and Welfare Canada manages the Canada Pension Plan (CPP) 
and Old Age Security programs, recording earnings and 
contributions. Employment and Immigration controls the 
Unemployment Insurance program which includes earnings, work 
history, benefits payed, and the Social Insurance Number (SIN) 
master list. 


These main departments share information among themselves, 
primarily for financial checks and balances. For example, each 
year Revenue Canada gives Health and Welfare (through Supply 
and Services’ computers) information on individuals’ contributions 
to CPP, while Health and Welfare tells Revenue Canada about the 
CPP payments they make to individuals. 


Chart 1 shows how the government collects some of its 
information from individuals and transfers it to other agencies. 
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_ Key Transfers of Personal Information 
Chart 1: in the Federal Government 
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Statistics Canada holds information about more Canadians 

(27.3 million) than any other agency, most of it drawn from the 
census. Everyone provides basic personal data, as well as their 
marital status, language, whether they own or rent their housing 
and who pays the household bills. One in five households provide 
more details, including ethnic origin, religion, physical and mental 
limitations, employment and income. Although this information is 
very personal, Statistics Canada uses it only for statistical 
purposes. Individuals’ names are not entered into the computer 
(but the paper copies are kept). 


Statistics Canada also conducts surveys such as those on 
consumer finances, health and work history. As well, the agency 
maintains long term databases on cancer and tuberculosis 
patients, dental hygienists, registered nurses and elementary and 
secondary school teachers. 


Other agencies gather data from operational programs dealing 
with immigrants, native peoples, homeowners, Canada Savings 
Bonds purchasers, students, farmers, people who have changed 
addresses, and criminals. Some people’s dealings with the 
government necessarily mean providing more details. For 
example: 


¢ Immigrants and Refugees 
Some 6,670,000 individuals have immigrated to Canada since 
the Second World War. Their files can contain information about 
education, work history, financial situation, physical and mental 
health, social and political involvements, criminal activities and 
family situation. As well, the government collects data about the 
immigrant’s sponsors or hosts. 


¢ Native Peoples 
The government has a master index of approximately 530,000 
registered status indians, as well as paylists (including family 
members) for those receiving treaty payments. There are also 
nominal roles of students living on reserves, attendance records 
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and grades of those attending federal schools and case files of 
reserve children and families who receive various social 
services. As well, there are trust fund accounts, a land registry, 
small business loan funds and artist and prospectors’ programs 
containing a range of personal and financial information. 


Pensioners 

Pensioners’ information falls into both financial and medical 
categories. There are Canada Pension Plan, Guaranteed 
Income Supplement and Spouse’s Allowances files, all 
containing earnings and payments information. The Old Age 
Security Program alone has approximately 3,250,000 accounts. 
Pensioners receiving disability pensions also supplied detailed 
medical information to support their applications. 


Veterans Affairs also maintains 550,000 accounts for veterans’ 
pensions and benefits. These files can contain sensitive medical 
information, including complete medical and drug histories on 
patients in veterans’ hospitals. And since some veterans 
programs impose a means test to determine benefits, some files 
contain financial information. 


Armed Forces Members 

The dictates of their profession mean government has 
substantial information on current and former armed forces 
members. All members provide fingerprints, undergo security 
assessments and medical examinations. Since the forces 
provide members with ongoing medical care, there are detailed 
medical and dental files, and occasionally hospital reports. 
Inevitably members have training and education files, the latter 
particularly if the member attended a military college. There will 
also be personnel records, including performance evaluations, 
awards records, social services or disciplinary records. As well, 
the forces collect information on family members, particularly 
when the family lives on a military base or is posted with the 
member. 
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¢ Inmates and Parolees 
Current inmates and parolees will have a wide range of 
personal data in the files of the RCMP, Correctional Services 
Canada and the National Parole Board. These can include 
criminal history and court records, medical and psychiatric 
reports, disciplinary measures imposed, intelligence reports, 
appraisals and recommendations from the parole board and 
victim impact statements. 


Those who worry about Big Brother can be reassured—there is no 
one central file containing all these personal details. Some federal 
departments do share and match personal information but must 
respect policies and rules set out in various acts. Some federal 
agencies exchange information with provincial governments under 
formal agreements. For more details, see /nfo Source, the annual 
directory of the federal government’s information holdings. 
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Corporate Management 


Corporate Management provides both the Information and Privacy 
Commissioners with financial, personnel, administrative, 
informatics and library services. 


Finance 


The Offices’ total resources for the 1992-93 fiscal year were 
$6,761,000 and 85 person-years, an increase of $70,000 and 
three person-years over 1991-92. Personnel costs of $5,351,077 
and professional and special services expenditures of $642,835 
accounted for more than 88 per cent of expenditures. The 
remaining $765,086 covered all other expenses. 


The following are the Offices’ expenditures for the period April 1, 
1992 to March 31, 1993* 


Information Privacy Corporas Total 
Management 

Salaries 1,923,405 2,066,562 609,110 4,599,077 
BU Sch aehadeelal chills 306,000 342,000 104,000 752,000 
Contributions 
ce eee ae 36,468 96,722 134,107: 267,297 
Communication 
Information 26,954 69,435 2,242 98,631 
msc hele 402,524 107,240 133,071 642,835 
Special Services 
Rentals 9,275 66 12,107 21,448 
BeOS Tea Tae tee Ie 14,758 790 25,511 41,059 
Maintenance 
eta liehe Cleese 18,887 11,762 36,841 67,490 
Supplies 
MEN EC AIDE 86,709 47,680 130,192 264,581 
and Equipment 
Other Payments 2,434 1,475 671 4,580 


TOTAL 2,827,414 2,743,732 1,187,852 6,758,998 


* Expenditure figures do not incorporate final year-end adjustments reflected in the 
Offices’ 1992-93 Public Accounts. 
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Personnel 


The unit provided support for restructuring both Commissioners’ 
offices and began implementing the government-wide classification 
simplification project. The Offices approved a new policy on leave 
and introduced an employee assistance program. 


Administration 


The branch reviewed office accommodation and made some 
improvements. In addition, it introduced new government initiatives 
to speed up the procurement of goods and services. 


Informatics 


The Offices received funds to update the case management 
system and have established a local network and introduced new 
office automation tools. 


Library 


The library provides interlibrary loan services, conducts manual 
and automated reference and research, and maintains 
Subject-oriented media monitoring files. In addition to information 
on freedom of information, the right to privacy, data protection and 
the ombudsman function, the library has a special collection of 
Canadian and international ombudsmen’s reports and 
departmental annual reports on the administration of the two acts. 
The library is open to the public. 


During the year, the library acquired some 560 new publications 
and answered 1006 reference questions. 
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Privacy Commissaire 
Commissioner a la protection de 
of Canada la vie privée du Canada 


The Honourable Gildas L. Molgat 
The Speaker 
The Senate 


Ottawa 


July oS 


Dear Mr. Molgat: 


i 


| have the honour to submit to Parliament my annual report. 


This report covers the period from April 1, 1994 to March 31, 
mI95. 


Yours sincerely, 


tle Ce SE be 


Bruce Phillips 
Privacy Commissioner 
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Privacy Commissaire 
Commissioner ala protection de 
of Canada la vie privée du Canada 


The Honourable Gilbert Parent 
The Speaker 

‘The House of Commons 
Ottawa 


July 1995 


Dear Mr. Parent: 


} 
| 


| have the honour to submit to Parliament my annual report. 


This report covers the period from April 1, 1994 to March 31, 
1995. 


Yours sincerely, 
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Gerard J. C. van Berkel 


| 
| Gerry van Berkel died on January 5, 1995, barely six months after 


retiring as general counsel to the Privacy Commissioner, a position he 
held since the Office was created in 1983. 


. He was both an extraordinary human being and an unusual 
lawyer. The poet Marvell's words are apt: "He nothing common did or 
‘mean, upon that memorable scene". He had an expansive view of the 
law, seeing it as an instrument for human betterment, rather than a code 
of strictures for human regimentation. He was often heard to say that 
"the law should not stand in the way of helping people", and this 
attitude, animated by his common sense and compassion, made him an 


ideal counsel for an ombudsman's office. 


Gerry van Berkel had been a government lawyer for three 
decades, having served as well in the Department of Labour and the 
‘Canadian Human Rights Commission. Wherever he went, he left behind a 
legion of friends and admirers. The staff of this Office were the particular 
beneficiaries of his mature wisdom, his wit and his patience; not to 
mention his good humoured tolerance of their gratuitous and unschooled 
legal opinions. 

: But they also knew him as a raconteur of note, chef 
‘extraordinaire, mean pop pianist, gifted cabinetmaker, but above all, 
devoted family man and loyal friend. All in all, a formidable work of the 


Creator in whom he had an abiding faith. 


To him, in love and respect, this report is dedicated. 


Mandate 


The Privacy Commissioner is a specialist ombudsman appointed by 
and accountable to Parliament who monitors the federal government's 
collection, use and disclosure of its clients' and employees’ personal 
information, and its handling of individuals’ requests to see their records. 


The Privacy Act gives the Commissioner broad powers to 
investigate individuals’ complaints, to launch his own complaint, and to 
audit 110-odd federal agencies’ compliance with the Act. He also 
conducts research on his own behalf or at the request of the minister of 
justice. 


Mission 


The Privacy Commissioner's mission is 


@ to be an effective ombudsman's office, providing thorough and 
timely complaint investigations to ensure Canadians enjoy the 
rights set out in the Privacy Act; 


M@ to be an effective privacy guardian on Parliament's behalf, 
performing. professional assessments of the quality of the 
government's adherence to the Privacy Act; 


M@ to be Parliament's window on privacy issues, arming it with the 
facts needed to make informed judgements through research and 
communications; 


M@ to be the primary national resource centre for research, 
education and information on privacy. 


Highlights 


@ Federal government leadership needed now to protect 
Canadians’ privacy in the private sector—starting with the 
banking, telecommunications and interprovincial transportation 
sectors where it has jurisdiction (page 6) 


Mi Changes to the census to better protect Canadians’ 
privacy —and an outstanding issue (page 33) 


@ End to random drug testing of Forces' members (page 16) 


HM How to devise an electronic privacy system—Public Key 
Infrastructure (page 8) 


M@ Safeguards for the public's and employee's tax files during 
internal Revenue Canada investigations (page 22) 


HM Removal of gratuitous personal details from public bankruptcy 
files (page 7O) 


@ Improved controls on disposal of surplus assets— computers, 
diskettes and file cabinets (page 60) 


@ 1307 complaint investigations and almost 10,000 inquiries 
handled; a record 1,783 new complaints (page 31) 
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There is a tide in the affairs of men, 

Which, taken at the flood, leads on to fortune; 
Omitted, all the voyage of their life 

Is bound in shallows and in miseries. 


—Julius Caesar, Act IV, Scene III 


Right on, Mr. Shakespeare! Nowadays we're not so elegant of 
speech. Translated into 1995-ese, we'd probably say "Let's move it", or 


something even more blunt. But the meaning is the same: the time for 
action is now. 


Events have moved swiftly in the past year. We are now at 
that critical point at which decisions must be made which either will "lead 
on to fortune" or to "shallows and miseries". 


Those decisions in the main are in the hands of our 
governments, so this is a plea to them to meet this Opportunity with 
courage and foresight, resisting along the way the inevitable pressure 
from special interests for weak-kneed half-measures. Timidity in defence 
of human rights is no virtue. 


But first let's step back for a moment and scan the landscape 
across which we are travelling. Most people now are aware of the 
immensity of the changes which technology is working on society. 
Information technology in particular is throwing dazzling lights of 
knowledge across the worlds of commerce, academia, science, medicine 
and government, in fact every aspect of human life. But we must take 
care that the light does not blind us to our duty to ensure that we reap 
those benefits without sacrificing older values essential to the protection 
of human rights which are the foundation of civilized society. 


Over centuries of evolution of Western thought, one constant 
has been the acceptance of the individual's right to defend that 
uniqueness by exercising some control over the ability of others to intrude 
or impose. The technology revolution is making a shambles of that right. 


"Information" is not a single substance or entity. It is not just 
data. It is not a product or a commodity. Whether conveyed by voice, 
recording, printed word, picture, digitized code, sign language or sight, 
information is the expression of all that we know and are. Personal 
information expresses the substance of individual lives; in short, all the 
things which distinguish one human being from another, which certify the 
uniqueness of each individual. 


"Privacy", in fact, is not a word adequate to describe the 
problem. In the technological context, some experts describe it as "the 
right to informational self-determination", or the right "to control what 
others know about you". These are good descriptions, but they only 
reflect a more profound underlying issue—the degree to which, in the 
new information age, we will respect each other as individual human 
beings. 


Brave new words 


Previous reports have attempted to alert Parliament and public 
to the lethal threat to the preservation of some reasonable degree of 
personal privacy posed by the indiscriminate or unthinking application of 
information technology. Now, it must be said, there has been a 
significant change in the level of public awareness. Poll after public 
opinion poll has demonstrated rising public uneasiness. Routinely they 
show 80 or 90 per cent of those interviewed are concerned about the 
assault on their privacy. They suspect, rightly, that much is going on 
which is not explained adequately to them, and that worse may be to 
come. 


These polls frequently also show that such fears are coupled 
with a strong appetite for government action. The public knows the 
world is changing swiftly, and is anxious not to be left naked in an 
environment more threatening to personal autonomy than anything we 
have known before. From a state of general indifference, privacy 
protection has forced its way, if not onto centre stage, at least to 
reasonable prominence on the agenda of issues worthy of attention. 


Doubtless this is less the result of any individual effort than 
the accumulation of evidence obvious to almost everyone—this is not 
simply an abstract philosophical problem but one that affects everyday 
life. Whatever the reason, we have attained the necessary pre-condition 
to effective action. However, we must not confuse recognition with 


solutions. There is much talk but few results. But compared with a few 
years ago, even that is real progress. 


One thing is abundantly clear. The next year or two will tell 
the tale, whether as a society we care enough about our personal 
autonomy and individuality to defend it against the clamant pressures of 
the economic bottom-line, or are content to see ourselves digitized into 
data subjection. 


There is nervous optimism. Optimism because there is strong 
support in important quarters for enhanced privacy protection in the age 
of information technology. One such notable support is the committee 
work of the government's Advisory Council on the Information Highway 
(of which more later). The nervousness stems from the power of private 
interests to resist change, coupled with a prevailing climate which 
militates against government action in the commercial sphere. Even times 
such as these, however, offer no justification for failing to protect those 
defining values. Easy times and not-so-easy times come and go. Respect 
for human rights must remain the bedrock of society, immune alike to 
breeze of prosperity and blast of hardship. 


The issue is clear: the preservation of a private life in the 
information age depends upon our retaining some control over what the 
world knows about us. This control has all but disappeared except in the 
limited areas where privacy laws exist; principally in the public sector. 
Only stronger legal defences can restore control. 


There is now almost universal agreement with these two 
propositions. The Canadian private sector, which generally operates free 
of any legislated privacy rules (except in Quebec) now recognizes the 
rising tide of public concern. Many businesses have attempted to meet 
this concern by drafting their own privacy codes. And there's the rub. 
While conceding a problem, there is still much opposition to the idea of 
anything more than "voluntary" or "self-regulated" observance of privacy 
rights. That's to say, we know there's a traffic problem but please, no 
traffic cop. 


Optional privacy rights? 


Reluctantly, and by stages, this writer has come to the view 
that "voluntarism" is inadequate. The reasons are several. The first; 
collection of personal information, much of it without our knowledge or 
consent, is now a huge business and getting more huge all the time. As 
individuals, we have a right to exercise some control over this traffic, but 
all the Jjawboning of recent years has had little impact. 


The second reason; technology is accelerating this process, 
and the longer it proceeds devoid of enforceable standards, the worse the 
problem will become. 


Third, such protections as now exist are in danger of erosion, 
because of impending interconnectivity between public sector data bases, 
which are covered by privacy laws, and private sector data bases and 
transmission systems, which are not. 


Fourth, Canadians are entitled to uniform standards of respect 
for their privacy rights no matter where they live or in what business they 
are engaged, a situation which can never be achieved if left to the whims 
of the marketplace. 


Fifth, public confidence in any system is unattainable without 
provision of just rules equally and fairly applied to all segments of society, 
public and private sector alike, and fortified by a mechanism for 
independent oversight and complaint resolution—in short, a traffic cop. 


Holding the system accountable 


Lest we be deflected by uninformed arguments about creating 
“massive bureaucracies" and "armies of government snoops", let's 
examine some recent experience. Less than two years ago, the Quebec 
legislature amended its privacy laws to extend their reach to cover private 
businesses in the province. The Quebec Commissioner reports that the 
transition has taken place smoothly, business continues to be done, the 
sky has not fallen, no-one has complained about excessive or 
unwarranted intrusions by government snoops. And the bureaucratic 
explosion? The Commissioner, although he has received about 300 
complaints involving the private sector, has added fewer than half a 
dozen persons to his staff. 
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For that matter, this Office in its twelve-year lifetime has 
investigated about 10,000 complaints covering more than 110 
government departments, agencies and tribunals, yet has never had a 
staff of much more than about three dozen persons. In addition to those 
investigations, this small staff has audited the information management 
practices of roughly a third of the government's operations, and 


conducted active research, policy and public affairs programs. So much 
for bureaucratic bloat. 


Another argument gaining some currency is that each sector 
of the commercial world should have its own privacy watchdog, e.g., the 
Canadian Radio-Telecommunications and Television Commission for the 
communications sector, the Canadian Transportation Commission for 
transportation, the Office of the Superintendent of Financial Institutions 
for the banks, and so forth. Unless people are willing to discard all their 
concerns about bureaucratic growth, level playing fields and uniform 
Standards, these arguments should get the quick dismissal they deserve. 
Not a single jurisdiction in the world where business is governed by 
privacy laws (and that includes most of Western Europe, Britain, New 
Zealand and Australia) has ventured down that thicket-strewn path. 


The danger of having various industry privacy agencies is the 
tendency to develop cultures highly reflective and sympathetic to the 
industries they regulate. There must be genuine independence of thought 
from those whose interest, first and foremost, is privacy. We do not 
have separate police departments for each offence but one department 
with several specialties. The police act on behalf of the whole 


community and are expected to apply a common standard equally across 
the whole of that community. 


Charting the course 


Therefore | put the simple proposition: if the world is changing 
in ways which threatened established and accepted rights, then so must 
change the laws which are needed to fortify and defend those rights. 


The conclusions are inescapable: 
M@ privacy protection cannot be left to the whim of the 


marketplace, but deserves and needs to be re-enforced by 
legislated standards; 


M legislation must cover both the public and private sectors; 


MM action is needed at both federal and provincial levels, and 
steps must be taken to seek the maximum attainable 
harmonization of law and enforcement; 


@ legislated standards must be supported by an independent 
oversight and compliance mechanism, without which the 
standards would be merely ineffectual statements of good 
intent; 


@ the social and technical impact of information technologies 
needs systematic assessment by an independent, expert body 
similar to the U.S. Office of Technology Assessment. 


Both provincial and federal governments occupy important 
jurisdictional positions in the information world. Ideally, both levels would 
implement complementary legislation more or less simultaneously, 
supported by similar oversight methods, resulting in uniform and complete 
coverage of the Canadian information spectrum. Realistically, such an 
outcome is likely to demand far more time than the urgency of the 
situation demands. Technology continues its onward rush; if none acts 
until all act, much that could be saved will be lost. 


No time to take our time 


Given the national nature of the problem, the responsibility 
naturally falls upon the national government to exercise leadership. It is a 
fortunate happenstance that some of the major sectors of commerce fall 
within federal jurisdiction. These include telecommunications, 
transportation and banking, three of the most important sectors to collect 
and use personal information. The federal government thus has the 
opportunity to seize the initiative and, acting within its own jurisdiction, 
make the federally-regulated private sector subject to the federal Privacy 
Act—as it is subject to federal human rights, official languages and labour 
laws. 


This action could be supplemented by adding to the Privacy 
Act provisions specifically tailored to the private sector, such as the 
model privacy code developed by the Canadian Standards Association. 


This second option has some appealing advantages. It would 
embody in law a set of rules devised by a committee representing a broad 
cross-section of Canadian private enterprise. The major improvement 
between the situation today and the one this approach proposes is that 
observance of the CSA standards would become a legal obligation and 
would be supported by a system of independent oversight. A further 
advantage is the potential for provincial acceptance, since the enterprises 
represented on the CSA committee operate in both jurisdictions. In 
addition, the code has won the endorsement of several provincial privacy 
commissioners as an excellent basis for legislation. Thus we have at 
hand a set of privacy rules which, given the necessary teeth, already 
enjoy substantial acceptance at both federal and provincial levels. 


In summary then, the federal government should strengthen 
Canadians’ privacy protection by 


M@ extending the Privacy Act to those areas of the private 
sector which fall within its jurisdiction, and 


M@ convening a federal provincial working group to seek 
harmonization of privacy laws in the private sector under 
provincial jurisdiction. 


To end at the beginning, the tide is at the flood. Let's not 
miss it. 


On such a full sea are we now afloat, 
And we must take the current when it 
serves, 

Or lose our ventures. 


—Julius Caesar, Act IV, Scene III 


Update: Privacy, Security and 
the Information Highway 


Few subjects have spilled more ink or prompted more sound 
bites during the past year than the information highway. Lost in the hype 
was the Information Highway Advisory Council's call on the federal 
government "to act to ensure privacy protection on the information 
highway". 


The council is a joint industry/consumer/academic group 
appointed by the federal government to develop a strategy for Canada's 
information highway. Among the issues it examined were protecting 
privacy, and a related concern—protecting security of interactive systems 
and the data they carry. 


Privacy and security are not the same, of course. The 
distinctions are important—a secure data network may protect against 
intrusions by unauthorized users but it offers the subjects no protection 
against overzealous collection and misuse of their personal information, 
nor against inappropriate disclosures by the controllers and authorized 
users. 


Protecting privacy 


The council's discussion paper, Privacy and the Canadian 
Information Highway, set out the privacy threats and asked Canadians to 
comment on the balance between freedom of information and the threat 
to personal privacy posed by the information highway. 


Public responses (including one from this Office) convinced the 
council that Canadians are worried that their personal, medical and 
financial records are at risk on the information highway and they want 
effective privacy protection. The council concluded that the federal 
government had to take the leadership in protecting personal information. 


Although its final report is not expected until this fall, the 
council has already acknowledged publicly the need for a national 
standard—covering all the public and private sectors—to protect 


Canadians' privacy in an electronic environment. To accomplish this, the 
council recommended 


M@ establishing a level playing field by developing national, 
flexible privacy framework legislation to set a minimum fair 
information standard, and citing the Canadian Standards 
Association draft "Model Code for the Protection of Personal 
Information" as that standard; 


M@ establishing a federal-provincial-territorial working group to 
implement the principles across Canada: 


HM updating and harmonizing the government's own privacy 
protection policies, legislation and guidelines; 


@ setting up a working group to coordinate the development 
and application of privacy enhancing technologies for delivery 
of government services and information. 


Particularly heartening is the council's recognition that while 
voluntary standards are useful for engaging business in privacy 
protection, government must pursue development of effective oversight 
and enforcement mechanisms, otherwise what becomes of clients of 
companies that decline to "volunteer"? 


Ensuring security 


Security is a critical issue in interactive networks, to protect 
both stored data as well as personal and business communications. 


Nevertheless, the council recognizes that no security measure 
or technology can offer absolute protection for information. It 
recommends a basic level of security that "provides a reasonable 
expectation that private communications and personal information will be 
protected". The market would be left to devise and sell enhanced 
security protection for more sensitive data. 


Striking the right balance between privacy, civil and human 
rights, law enforcement and national security on the information highway 
will require extensive study and public consultation. One method of 
securing Communications and data on the highway is to build a public key 
infrastructure. 


In the interests of starting the debate, some definitions are in 
order. 


From post box to E-mail to public key 
infrastructure—a primer 


Security of the mail has long been critical to public trust in the 
postal service. We expect our mail to be delivered to the addressee in a 
way which ensures the confidentiality of the message. We seal it in an 
envelope and entrust it to a postal system which collects, routes and 
delivers the communication. 


Essential to the process is our knowledge that the system Is 
confidential and protected by law. No matter how many truck drivers, 
sorters and letter carriers handle a letter, we rely on the system to deliver 
it to its destination unread, unaltered and intact. 


Electronic Mail or E-mail is simply a communication sent 
electronically by connected computer systems rather than by letter mail. 
But electronic mail offers no sealed envelopes to protect confidentiality or 
trusted system to ensure safe delivery. Neither the sender nor the 
recipient has any control over (or knowledge of) who reads their E-mail 
while in transit. A message sent in the open over a computer system 
means anyone with access to the system can read, record, monitor, 
tamper with or destroy the communications before it arrives at its 
destination. 


One solution to protecting E-mail is encryption, and, to 
confirming the source of messages, authentication by digital signatures. 
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Encryption 


Encryption renders a plain text message unintelligible to all but 
the intended recipient who has the key to decipher the code. The 
message is encrypted using mathematical processes, called algorithms, to 
transform plain text into cipher text and vice versa. Algorithms are 
simply coding systems for concealing the meaning of a text— analogous 
to conventional locks. 


Along with algorithms, encryption also uses keys. Keys can 
be numbers, characters, or phrases (in the form of digital bits) used by an 
encryption algorithm to lock or unlock the transformed message. The 
encryption key fits with the algorithm to lock or unlock it. 


Secret key v public key encryption 


Two encryption methods are popular today: the secret, shared 
single-key type and the public/private two-key type. 


In a single, shared key system, both the sender and the 
recipient must share the same, secret key to either encrypt or decrypt the 
message. The drawback of this traditional system is that the sender and 
recipient must share the key with each other. When there are many 
correspondents, the sender must share a different key with each of the 
intended recipients and all must be kept securely. 


The second method, known as public key cryptography is 
based on having an associated pair of keys: a public key (known to many) 
to encrypt the data; and a private key (known only to one party) to 
decrypt the data. While the keys make a matched pair, one cannot derive 
the private key from knowing the public key. 


In this system, someone wanting to receive confidential 
information can distribute their public key widely; for example, ina 
directory. Anyone wanting to send a protected message to that person 
could look up his or her public key and use it to encrypt their message. 
The message could only be decrypted by the person holding the 
corresponding private key. No one else, not even the person who 
encrypted the message, could decrypt it. 
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Digital signature—identifying the sender 


Electronic communication systems must also be able to 
authenticate both the sender and the message. A handwritten signature 
serves as tangible proof of the origin of a conventional letter (a signature 
can also differentiate an original document from a copy) but one cannot 
physically sign an electronic document—merely indicate who it is from. 


Electronic messages can be altered, or the sender simply 
masquerade as someone else. Several politicians have recently had 
electronic words put in their mouths on electronic chat groups and 
bulletin boards. Electronic communications require that trusted digital 
equivalent of a handwritten signature. 


Public key encryption can provide that trusted signature by 
reversing the roles of the public and private key. The sender simply 
encrypts the message with the recipient's public key and attaches a 
signature block encrypted with his or her own private key. 


The recipient can open the message in the normal way with 
his or her own private key and also verify the sender's identity by 
decrypting the signature block with the sender's public key. 


Appending a signature block that has been encrypted with the 
sender's private key is like signing and sealing the document. Only one 
person is associated with that particular private key; the identity can be 
verified by the corresponding public key and cannot be denied. 


Authenticating the message—the "hash" code 


Along with the signature block, the sender's encryption 
program also creates a unique mathematical summary or picture of the 
message being sent. This is called a "hash code". The recipient's 
encryption program reads the message, creates the hash code of the 
message received (a "rehash") and compares it with the hash code in the 
sender's signature block. If the two codes match, the message has not 
been altered. 
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Building a public key infrastructure 


Encryption protects the confidentiality of E-mail and digital 
signatures prove the origin and authenticity of the message. Used 
together, they can provide electronic privacy. 


But one question remains: Who will be the trusted delivery 
and address system—the equivalent of the traditional postal service? 
How do we obtain our public/private key pair, how can we be assured 
that a certain public key is linked with a certain individual, and how do 
we get each other's public key? 


The answer lies in creating a trusted authority to generate the 
key pairs, to certify the validity of those keys, and to manage the secure 
distribution of the keys. In short, this means a central administrator to 
vouch for the identity and validity of the public/private key users and to 
maintain system security. The authority must also provide key 
management, such as producing a directory of public keys to ensure that 
users have access to one another's public keys, and issuing public notices 
of compromised or revoked keys. 


The federal government has recognized the need to develop an 
infrastructure and has taken preliminary steps to assess departmental 
needs, propose a concept of operation and work with the private sector 
to develop a model and uniform standard. 


However, vigorous public debate is needed before the 
government hands any agency the keys to the kingdom. 
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Update: A Model Privacy Code 
for the Private Sector 


The most ambitious attempt to protect privacy in the private 
sector has been the Canadian Standards Association's work to produce a 
model code for Canadian business. The CSA initiative brought together a 
working group of disparate private and public sector representatives to 
devise a privacy standard to which all could subscribe. 


The members include representatives of public and private 
sector users of data, organizations representing the data subjects 
(employees and consumers), the technology industry, and the federal and 
Ontario privacy commissioners. 


The work has been hard but there has been considerable 
success. The group circulated its first draft for public comment on 
December 31, 1994 and the verdict is in. The code's statement of 
fundamental principles is at least as good as—and arguably better than 
those contained in the Privacy Act. 


The first principle makes each organization responsible for the 
personal data under its control and requires it to designate an individual to 
be accountable for its compliance with the fair information principles. 
These are identifying the purposes for collecting information, ensuring the 
individual is informed and consents, limiting collection and gathering by 
fair and lawful means, limiting collection, use and disclosure, ensuring 
accuracy, protecting the data, making its personal information handling 
policies and practices "readily available", providing individuals access to 
their personal data and establishing their right to challenge its accuracy 
and completeness, and providing individuals with the means to challenge 
the organization's compliance with the principles. 


The code is thorough and complete, and it was conceived by 
the private sector to be relevant to the private sector. This is a hopeful 
beginning. 


The Office embarked on the CSA project four years ago, 
committed to support any scheme that would meaningfully advance 
Canadians' privacy rights. A model voluntary code was in keeping with 
the times. But as the threats from technology evolve, so must the 
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solutions. It is evident that a self-regulatory and entirely voluntary code is 
out of step with both the enormous social implications of technological 
change, not to mention rising public concern. Depending on an entirely 
voluntary privacy scheme in an era of Internet, Pharmanet, electronic 
wallets and smart cards requires a suspension of belief. 


Statements of good intent are no longer good enough. 
Canadians need and deserve better. Anything less than enforceable 
privacy rights and independent oversight will be ineffectual. Stacking an 
individual's privacy rights against the potential economic returns of, for 
example, database marketing is, at best, an uneven fight. Voluntary 
codes not only deprive the public of legal protection, but may well 
deceive us into relying on a chimera. 


The greatest significance of the CSA Code may lie, not in its 
proposed form as a voluntary code for business, but in its embodiment 
into national framework legislation—a national standard of privacy 
protection against which all sectors can be held accountable. The 
Information Highway Advisory Council has recognized the code's place as 
the basis for legislation, coupled with an effective oversight mechanism. 
The Commissioner can only applaud. 


However, the bottom line is that the rules must be clear, 


everyone must play by them, and they must be enforceable. Optional 
privacy protection is simply not good enough. 
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Update: Biomedical Privacy 


The watch on drug testing 


The watch on federal government drug testing schemes 
continues. Mandatory drug testing, lauded as the quick fix to employee 
drug abuse, is a serious privacy intrusion—surrendering a bodily 
substance to allow others to ascertain one's past behaviour. 


The invasiveness of the procedure and its overtones of 
surveillance demand that advocates of testing (and there are many) justify 
the intrusions by demonstrating that drug abuse is a problem in the 
workplace, that drug testing achieves some valuable objective such as 
increased safety, and that other, less intrusive, measures would not. 


Some have read the position as somehow supporting use of 
illicit drugs. Hardly. The message is clear—dealing effectively with drug 
abuse requires education, Support, treatment and, in some cases 
removing workplace conditions that may well cause or exacerbate 
employees' problems. Massive mistrust of employees and finger-pointing 
are not the answer. 


National Defence drops random tests 


One of the first tests of the Office's position came in a May 
1992 Order-in-Council authorizing the Department of National Defence 
(DND) to conduct a broad range of testing programs on members of the 
Canadian Forces. The program included random testing for deterrence, 
post accident, suspected cause and as part of a drug-related probation or 
treatment program. The program targeted illegal drugs, not alcohol, the 
most widely used and, one might argue, the most frequently "abused" 
drug in the Canadian Forces. 


A thorough analysis of members' drug and alcohol use, using 
DND figures collected from its 1989 Canadian Forces lifestyle survey, 
showed that, like their civilian counterparts, Forces members rarely report 
using illegal drugs. About six per cent of Forces' Members used 
marijuana within the last year, slightly less than the public at large. 
However, members drink more frequently; 84 per cent of members 
reported having a drink in the past year, compared with 78 per cent of 
the Canadian public. 


6 


Since DND's own survey failed to demonstrate that its 
members had a serious problem, the Commissioner wrote to the Chief of 
the Defence Staff early in 1994 opposing widespread random testing of 
Forces' members. 


In February 1995, current Chief, General A.J.G.D. de 
Chastelain, wrote to advise that he had indefinitely suspended the random 
testing component of the program—one of its most objectionable 
features. He reserved the right to "reopen the issue if future 
circumstances dictate". 


This is an important event in the annals of Canadian drug 
testing. General de Chastelain's decision to suspend random drug testing 
is a blow for common sense and sets an example for public and private 
sector organizations contemplating drug testing as the "fix" for perceived 
workplace problems. 


DND will rely on education and counselling but will continue 
testing following an accident to determine whether alcohol or illicit drugs 
were a factor. DND's own reports found that drugs were not a factor in 
any of the nine accidents investigated over a two year period. 


Dusting for dope 


The news is less promising in the private sector. In late 
March, an American company launched a home drug testing kit— "Drug 
Alert" —targeted at worried parents and suspicious employers. 


The kit contains a piece of pre-moistened cloth that can be 
wiped across doorknobs, desk-tops and clothing to pick up traces of illicit 
drugs. The cloth is then placed in a sealed envelope and returned for 
analysis. The company promises to detect the presence of about 30 
illegal drugs. 


Assuming the testing process is accurate, the information it 
produces is ambiguous. The test does not confirm that the person used 
drugs; it merely shows contact with traces of a drug which could be 
completely innocent. Contact with other drug users could leave a residue 
sufficient to generate positive test results. Anyone who handles 
American (and likely Canadian) paper money may pick up traces of 
cocaine, given the bills’ frequent use as straws for inhaling the powder. 


Li? 


The most disturbing aspect of the kit is its marketing to 
capitalize on parents' understandable fears of childrens’ use of drugs. 
American "war on drugs" rhetoric spills over the border, misleading 
parents into believing there is an epidemic of drug abuse among Canadian 
students. Some students are indeed using illicit drugs but recent 
statistics demonstrate that while the levels of use fluctuate, all are down 
from the rates in the 197Qs. 


The kit is a device for spying on children and a surreptitious 
invasion of privacy. The consequences of error for parent-child 
relationships could be fatal. We once feared invasions of privacy by the 
state, then by the private sector. Must we now fear our own family? 


There appears to be no federal law preventing such 
surveillance. Several provinces have statutory privacy torts and Quebec's 
Civil Code and human rights charter protects citizens against spying. 
Parents who choose to invade their children's privacy and betray their 
trust this way could find themselves facing a civil lawsuit. They could 
also find the tables turned. Having had their own trust betrayed, children 
could try the tests on their parents. Is this the course we want our 
society to follow? 


There is also evident appeal to employers. Unlike urinalysis, 
this type of test does not require the knowledge or consent of the 
employee and need never attract the attention of human rights bodies. 
The Commissioner's strong objections to urinalysis pale beside those 
about secret drug testing. Although he has no legislative authority to 
prevent such testing, he is not afraid to lead the chorus for laws against 
its use. 


DNA testing in criminal investigations 


There has also been significant progress on the DNA testing 
front, specifically legal controls on forensic DNA tests. 


If nothing else, the O.J. Simpson trial has brought this once- 
arcane technology into the living rooms of the nation. Forensic DNA 
analysis is a valuable identification tool which can help convict or 
exonerate individuals suspected—or even convicted of acrime. The 
most recent Canadian example of its use is the case of Guy Paul Morin. 
Mr. Morin had been accused and convicted of the sex-related murder of a 
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child. Late in January 1995, advanced DNA testing proved conclusively 
—ten years after his arrest—that he had been wrongly convicted. 


However, the intrusiveness of this technique warrants careful 
regulation of the circumstances in which a criminal suspect should be 
required to supply DNA. 


The federal government recognizes the power of this evidence 
and need for its regulation. With this report in the final throes of 
preparation, the House of Commons passed Bill C104 amending the 
Criminal Code and the Young Offenders Act to allow forensic DNA 
testing. The Bill is before a Senate Committee. Once passed, it will 
provide a legislative framework for taking and using DNA in criminal 
investigations. (Still to come are amendments governing establishment of 
DNA databases.) 


Although the legislation appeared—at least to the public—to 
have been thrown together in a hurry, in fact the Department of Justice 
issued a consultation paper in September 1994 on obtaining and banking 
DNA forensic evidence. The paper paid considerable attention to the 
privacy implications of DNA analysis, Capturing many of the 
recommendations in the Office's 1992 report, Genetic Testing and 
Privacy. 


In January 1995, the Office responded to the Justice 
consultation paper, acknowledging the utility of forensic DNA analysis but 
entering several caveats. Bill C104 deals with, or undertakes to deal with 
most of these in a final round of amendments, promised for later this 
year. The amendments will address the storage and use of the samples 
(or their analysis). 


Many of Bill C104's rules on collecting and using DNA 
samples mirror the Office's recommendations. For example, 


Mi a judge must authorize the collection from the suspect; 


M@ testing is limited to a series of "designated offences", 
primarily sexual and/or crimes of violence: 


M@ a DNA sample must be relevant to proving the offence, 


investigators must have DNA from the crime to compare with 
the suspect's sample; 


ao 


@ analysis of the samples are to be used only to confirm or 
negate a match between samples from the crime scene and 
the suspect; 


HM DNA samples (and any analysis of that sample) must be 
destroyed immediately if the accused is acquitted, or within a 
year if the Crown does not proceed with a charge, withdraws 
the charge or enters a stay. 


Some of the Office's recommendations were not specifically 
incorporated in the current bill. The most important of these is rules 
establishing whether, how and for how long authorities keep the actual 
sample or only the analysis of the sample. The Minister has undertaken 
to deal with the important and sensitive issue of banking the samples or 
the analysis in subsequent amendments to be introduced later this year. 
Also needed is a provision establishing defendants’ rights to get access to 
samples from the crime scene to allow for independent testing. 


One of the remaining issues concerns police matching the 
analysis of a sample obtained under a warrant for one crime, with 
samples gathered at other crime scenes. We look forward to discussing 
rules for storage and subsequent uses of the data at the second round of 
amendments. This issue is simply too important for any 
misunderstanding. 


A model genetic Privacy Act 


Bill C104 is cause for cautious optimism. But controlling 
forensic uses of DNA is just the first step. We are less optimistic about 
the prospect for protecting genetic privacy in other areas—among them 
employment, insurance and human reproduction. The time may be right 
for other federal departments and indeed, all governments, to turn their 
minds to regulating these other collections and uses of DNA analysis. 


The publication by Boston University School of Public Health 


early this year of a model "Genetic Privacy Act" may kick start the 
process in Canada. 
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The drafters of the model legislation offered this summary of 
its philosophy: 


[T]he overarching premise of the Act is that no 
Stranger should have or control identifiable DNA 
samples or genetic information about an individual 
unless that individual specifically authorizes the 
collection of DNA samples for the purpose of 
genetic analysis, authorizes the creation of that 
private information, and has access to and control 
over the dissemination of that information. 


The rules protecting genetic privacy must be clear 
and known to the medical, scientific, business and 
law enforcement communities and the public. The 
purpose of the Genetic Privacy Act is to codify 
these rules. 


The Genetic Privacy Act, though drafted for an American 
audience, contains much that could be carried into Canadian law. Armed 
with this legislative template, Parliament has even less excuse for delay in 
addressing the increasing threat to our genetic privacy. 


a 


Update: Safeguarding Tax 
Files 


There are now stringent safeguards on using taxpayer 
information for monitoring Taxation employees, thanks to the efforts of 
Revenue Canada, the Union of Taxation Employees and the Office. 


A union representative wrote to the Commissioner setting out 
members’ misgivings about proposed amendments to the /ncome Tax Act 
and the Excise Tax Act (see 1992-93 report). Their concern centred on 
broad proposals allowing Revenue Canada to use taxpayer information to 
supervise, evaluate or discipline its employees. This would subject 
Taxation employees to harsher monitoring than other federal employees 
and diminish taxpayers’ confidentiality by allowing Revenue Canada to 
use their tax files for purposes unrelated to filing a tax return. 


Taxations' need to ensure the integrity of the tax system was 
not in question. But the proposals were drafted so broadly that there was 
potential for abuse. Setting out these uses in the /ncome Tax Act 
overrides a provision in the Privacy Act which prohibits using information 
obtained for one purpose (filing tax returns) for another purpose 
(supervising employees). The Commissioner wrote to Revenue Canada 
and the House of Commons Finance Committee recommending stringent 
safeguards. 


Revenue Canada offered to prepare draft guidelines 
establishing criteria and setting out controls for managers wanting to 
examine taxpayer and employee tax files during an investigation. They 
also offered to have the Office review the draft. Staff made several 
suggestions and the guidelines are now final. They include: 


M not examining an employee's tax return as part of the 
annual performance review; 


M@ protecting the confidentiality of taxpayers’ returns used as 
evidence during grievance or arbitration procedures; 
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M@ requiring an assistant deputy minister's authorization to use 
a tax return in an investigation of suspected serious breaches 
of either act (such as using insider information for personal 
benefit or altering a return to benefit or hurt someone else); 


M@ establishing an audit trail by keeping records of requests and 
Supporting reasons in the security division; 


M@ protecting the confidentiality of taxpayers whose tax returns 
are used as evidence in legal proceedings against employees 
(for example, by banning publication of those records, 
concealing the taxpayers' identities, or hearing selected 
evidence in camera). 


The deputy minister also agreed to have employees notified 
each time a director requests access to their tax returns. 


The Office will audit compliance with the guidelines. 
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Update: The Privacy 
Patchwork 


In Canada... 


In June 1994, Alberta passed its long-awaited access to 
information and privacy law. Beginning October 1995, the Freedom of 
Information and Protection of Privacy Act will provide Albertans with 
access to general government records, as well as to their personal 
information held by the government, municipal agencies, universities, 
school boards and health care agencies. The Act will also protect 
Albertans' privacy by establishing controls on provincial ministries’ 
collection, use and disclosure of their personal information. The 
commissioner (who is also the provincial ethics commissioner) is 
responsible for investigating complaints and monitoring compliance and 
has the power to make binding orders. 


By September 1994, the government of the Northwest 
Territories had also passed its Access to /nformation and Protection of 
Privacy Act to open its agencies' records to public access and give 
territorial residents the right to access and request correction of their 
personal information held by these agencies. The Act will come into 
force in December 1996. _ Its controls on the collection, use and 
disclosure of personal information by territorial agencies brings the 
Northwest Territories in line with the rest of the country's privacy 
protection regime. Complaints will be investigated by an ombudsman. 


The revised Nova Scotia Freedom of Information and 
Protection of Privacy Act came into force in July 1994. The Act, the 
fourth version of the Freedom of Information Act since 1977, is the first 
to include specific provisions protecting the privacy of provincial residents 
by controlling provincial government collection, use and disclosure of their 
personal information. Nova Scotians also have the right to access and 
request correction of their personal information held by ministries, 
municipal agencies, school boards and universities. Complaints are 
handled by a government-appointed Review Officer. 
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Prince Edward Island is now the only province or territory 
without any form of access to information, privacy or data protection law. 
However, following the March 1994 provincial throne speech, a 
legislative committee looked into the need for a freedom of information 
and privacy law. The committee recommended adopting such a law and 
its report includes suggested wording, apparently inspired by the Alberta 
legislation. If the government adopts the committee's recommendations, 
Prince Edward Island could fill the last hole in the public sector patchwork 
as early as 1996. 


Of course, the private sector remains unregulated, except in 
Quebec. 


..And Abroad 


The European Union Council of Ministers adopted its Directive 
on Data Protection on February 20, 1995 and has referred it to the 
European Parliament for ratification. The directive, first proposed in 
September 1990, spells out rules to protect Europeans' privacy and to 
control the processing and flow of their personal information. Clause 25 
of the directive may pose some difficulties for Canadian companies doing 
business with Europe because it prohibits member countries from 
exchanging personal information with non-member countries lacking 
adequate data protection laws. With the exception of Quebec, Canada 
has no privacy legislation protecting personal information held by the 
private sector, and proposed voluntary codes do not meet the directive's 
adequacy test. 
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In the Courts 


Privacy and Access of equal weight 


The Federal Court of Appeal, in its recent decision in Minister 
of Finance v. Michael A. Dagg (A-675-93), confirmed that the Privacy Act 
and the Access to /nformation Act have equal status and that disclosure 
of personal information under the Access Act is subject to the provisions 
of the Privacy Act. Given the implications of the trial judgment—second 
class status for the Privacy Act—the Privacy Commissioner intervened. 


Mr. Dagg, a private consultant, asked the Minister of Finance 
to provide him with employees’ after-hours sign-in sheets for specific 
days between September 1 and 30, 1990. He wanted to determine how 
many members of the Economists, Sociologists and Statisticians 
Association (ESSA) worked overtime on a regular basis. Dagg intended to 
calculate the total number of hours worked and sell this information to 
ESSA for use during the next round of collective bargaining. The Minister 
provided him with a copy of the sheets requested, but deleted the names, 
identification numbers and signatures of the employees. 


Mr. Dagg complained to the Information Commissioner, who 
agreed that the details were personal information. Dissatisfied, Mr. Dagg 
appealed the department's decision to the Federal Court. 

Mr. Justice Cullen concluded that the information was not personal but of 
a "predominantly" professional nature. He stated that government 
institutions were only bound to protect information whose predominant 
characteristic is of a personal nature. He added that “when there is any 
doubt as to whether information constitutes "personal information" which 
should or should not be released to members of the public, the benefit of 
the doubt is to be given to the interpretation which favours disclosure...". 


The Minister of Finance appealed the decision to the Federal 
Court of Appeal. 


The Chief Justice, writing for the Court of Appeal, overturned 
Mr. Justice Cullen's decision. The Court stated clearly that both statutes 
should be construed on the same footing. Both must be read together 
since section 19 of the Access to /nformation Act incorporates by 
reference certain provisions of the Privacy Act. Nothing in the language 
of either statute suggests that one is subordinate to the other. They are 
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complementary and must be construed harmoniously in order to attain 
Parliament's objectives. 


As for the "predominant characteristic" test, the Court held 
that it is clearly wrong, since it amounts to an unwarranted attempt to 
amend the definition of personal information in section 3 of the Privacy 
Act. The Chief Justice pointed out that the definition is broad, enlarged 
by nine classes of information or illustrations and four classes of 
exceptions. Information is either personal or it is not—there is no class of 
predominantly personal or predominantly non-personal information. 
Whether an employee is at a particular place at a particular time is 
information personal to that employee. 


Denied adjudicators' notes—case goes to 
court 


The Privacy Commissioner has taken a second case to the 
Federal Court (the first case was settled on the courthouse steps). He 
has asked the Court to review a Canada Labour Relations Board (CLRB) 
decision to deny a complainant access to Board members’ notes. 


The complainant had taken a complaint against his union to 
the CLRB which hears industrial relations disputes from organizations 
under federal jurisdiction. 


Dissatisfied with the Board's decision, he asked to see the 
panel members’ notes. (Although Board hearings are public, the 
proceedings often are not recorded—and were not in this case.) The 
Board refused to process the notes under the Privacy Act, considering 
they belong to panel members. The notes are not kept in CLRB files and, 
therefore, the Board argues that they are not under its "control". 


The Commissioner considers the notes are taken as part of an 
administrative process. They are not the personal property of board 
members but are prepared to fulfil their duties and so are under the 
control of the CLRB. The Act gives individuals the right to know what 
information is held about them in organizations subject to the Privacy Act. 
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The Commissioner's application asks the Court to order the 
CLRB to review the notes under the Privacy Act and to provide the 
complainant with access to his personal information, subject to any 
exemptions. 


The hearing is expected to be held in the fall. 


Consulting the Commissioner— 
MPs' pensions 


Departmental staff often call the Office to discuss balancing 
the public's right to know and an individual's privacy. A recent case 
illustrates the murky depths beneath what appears to be a placid surface. 


"Letting the facts get in the way of a good editorial" 


A political debate continues to swirl around the alleged 
profligacy of federal MPs' pensions and the Federal Court is now 
reviewing a department's denial of access to related information. This is 
a minefield for comment. Nevertheless, some gaps need filling. 


In order to pursue the Great MP Pension Debate, an individual 
asked Public Works and Government Services (PW&GS) to provide "Under 
the Member of Parliament Retiring Allowances Act (WPRAA) as of 
September 1, 1993, name of current recipients, identity of survivors, 
total amount paid for each and breakdown of member/government 
contributions". 


The department refused the request, arguing that the 
information was personal and therefore exempt under the Access to 
Information Act (subject to some specific exceptions). The applicant 
complained to the Information Commissioner who supported PW&GS' 
position, with one exception—the names. Since former MPs and their 
terms of office are listed in public documents, the Information 
Commissioner recommended the department disclose the names of MPs 
receiving pensions. Public Works sought this Office's advice. 


The Privacy Commissioner's role is not to advise departments 
when to release personal information. The Act clearly makes that the 
responsibility of the head of the agency who has both an intimate 
knowledge of the records and is answerable for their care. The 


20 


Commissioner simply sets out the factors the department should consider 
before releasing personal information. Departments have the option of 


M@ seeking the individuals’ consent to the disclosure: 


M@ determining whether there is a "public interest" sufficient to 
outweigh any invasion of privacy, or 


M@ concluding that the information is "publicly available". 


The department asked pension recipients for consent to 
release but many refused. The head did not consider the public interest 
sufficiently outweighed the individuals’ privacy interests and so did not 
use his discretion to release the information. 


"Publicly available" 


The argument in favour of disclosure in this case then focuses 
on the contention that the information is publicly available because names 
of former MPs could be assembled from the public record—for example, 
the Canadian Parliamentary Guide and the Canadian Parliamentary 
Handbook. Indeed the handbook lists serving MPs for every riding in 
every election between Confederation (or creation of the riding) and 
1988. The reader could determine who has accumulated six or more 
years service and therefore qualified for a pension. 


However, this merely establishes MPs' eligibility, not their 
actual receipt of a pension. There are sufficient variables — buy-back 
options or return of contributions for breaks in service and the inclusion of 
hundreds of MPs who have since died—to make the public data 
incomplete. 


The case begs several questions. If the information is already 
publicly available, why is a Court action—or, indeed, any action— 
necessary? How will releasing only the names respond to the applicants 
request? Why are there apparently several versions of the "correct" list? 
Why would the department be compelled to release a specific list of 
pension recipients because a general list or former MPs is publicly 
available? When the names of other surviving beneficiaries (spouses and 
dependents) are removed, will the list be accurate and complete? 
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Finally, how does knowing which MPs are collecting a pension 
help the public judge the appropriateness of the pension plan when all the 
information needed to assess the plan itself—the breakdown of MPs' and 
government contributions, interest, disbursements, withdrawal 
allowances and account balances are already open to public scrutiny? 


The department rejected the Information Commissioner's 
recommendations and the matter is before the Court. 
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Investigating Complaints 


Intake of new complaints recovered from last year's breather 
and hit an all-time high of 1783. This is an increase of 493 or 38 per 
cent over the 1290 received in 1993-94. Staff completed 1307 
investigations, of which 595 were well-founded, 645 not well-founded 
and 26 were resolved. The remaining 41 were abandoned or 
discontinued at the complainants’ request. 


The increase in complaints can be attributed at least in part to 
a 78 per cent increase in time limit complaints; in many instances the 
direct result of staff cutbacks and government re-organization. As well, 
a quarter of the 729 time limits cases were lodged by four individuals 
against the departments of National Defence, Revenue Canada and 
Correctional Services Canada. 


Time limits and denial of access complaints continue to make 
up the majority. However, complaints about improper collection, 
retention, use and disclosure of personal information ("privacy" 
complaints) climbed 22 per cent to 348 in 1994-95. Of these, 66 per 
cent concerned improper use and disclosure, 20 per cent improper 
collection and 14 per cent improper retention. Use and retention 
complaints are more complicated to investigate, often require travel (thus 
demanding more days to complete) and extend overall turnaround time. 


Contracting out—an update 


Last year's report discussed the Commissioner's concern that 
individual's privacy rights were being denied when departments 
contracted out services—the case in point was harassment investigations. 


At issue was individuals' access to documents gathered by an 
individual or company not subject to the Privacy Act but performing 
services under contract for a government institution that is. Some of 
these contracts specify that consultants are not to provide witness 
statements or other personal details but to deliver only the investigation 
report. In other cases, consultants have simply refused to disclose the 
information to the department, maintaining that they have promised the 
witnesses confidentiality. The legal question is, who has "control" of the 
records? 
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There has been progress. In a case this year against Public 
Works and Government Services, the deputy minister agreed that 
contractor's notes are under the department's control and to have them 
reviewed to respond to the complainant's application under the Privacy 
Act. 


Informal v formal access 


One issue discussed with Correctional Service Canada this 
year is the method it has established for giving inmates access to their 
personal information. 


Inmates have rights under the Privacy Act, including rights of 
access and correction, and the right to complain to the Privacy 
Commissioner—and ultimately to the Federal Court, if they believe they 
have been improperly denied access. However, to benefit from 
independent oversight, inmates must apply under the Privacy Act. CSC 
processes Privacy Act requests formally at ATIP Directorate at 
Headquarters. 


But inmates have another option. The Corrections and 
Conditional Release Act also gives them rights of access and correction to 
information held by CSC. Generally, CSC encourages informal requests 
because they are processed in the institution and so speed up the 
process. Each institution designates a staff member to help inmates 
phrase their requests. However, there is no recourse to an independent 
investigator. 


Although informal access is praiseworthy, the inmate should 
have the choice. Institutions should not establish processes that force 
an individual to forego rights under the Act for the sake of expediency. 
Some inmates will choose the formal process under the Act, either 
because they do not trust the institution or because they want to retain 
their right of recourse to an independent body. 


The "resolved" category 


Regular readers will notice a new category of complaint finding 
this year—the Commissioner considered several cases "resolved". The 
Office has struggled with past complaints for which "well-founded" 
appeared too harsh to fit what essentially had been miscommunication or 
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misunderstandings. The power of an ombudsman's role is the flexibility 
to solve problems—resolution is an ombudsman's stock-in-trade. 
Resolved cases are those in which 


M@ there was a misunderstanding or miscommunication 
between the complainant and department about what 
information was being sought. Both parties agreed to a 
mutually satisfactory solution; 


@ the individual claimed specific information was missing, the 
department maintained that it had disclosed the records but 
readily agreed to send it again; 


M@ the department had the right to exempt the information, but 
was persuaded by the investigator to exercise its discretion to 
release it; or 


M@ the investigation identified inconsistent processing of large 
volumes of information for an applicant, and the department 
was persuaded to release more information to make the 
disclosure consistent. 


The following are selected from the 1307 cases completed 
this past year. 


Counting privacy in—the census 


This year saw the Office complete its longest and most labour- 
intensive investigation—33 complaints about the last census. The results 
more than justify the time—they led to significant changes planned for 
Statistics Canada's next census in 1996. 


The census is the federal government's most extensive, 
expensive and potentially most invasive collection of personal 
information. Many would also argue that it is also the most valuable to 
society and the economy. 


The challenge is to seek a reasonable balance between the 
value of a census to the nation, and the inherent intrusiveness of any 
questionnaire. Where does a democracy draw the line between its need 
for reliable data and a healthy reluctance to compel citizens to provide 
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detailed information about their race, religion, lifestyle and health for a 
data collection that is never destroyed? 


This debate is broader than the mandate of a privacy 
commissioner and perhaps one that needs airing. In the meantime, 
investigators concentrated on the collection, use, retention and disclosure 
of Canadians’ personal data. To prepare, staff examined the history of 
the census, its justification and uses of the data, and comparable 
collections in other countries. With information in hand, staff attempted 
to resolve the 26 outstanding complaints. (The other seven were either 
not well-founded or discontinued.) 


The complaints fell into two broad categories; those 
concerning the "intrusiveness" of some of the questions, and those 
alleging that Statistics Canada's confidentiality guarantees were 
undermined by its collection procedures. First, the questions. 


The "intrusive" questions 


Most complainants objected to questions about their race, 
religion, fertility, housing, physical and mental health, or the number of 
"person(s) living elsewhere who stayed overnight". One woman, under a 
psychiatrist's care, was so upset by the question about mental and 
physical health that her husband tore up the form. Other complainants 
argued that any questions other than to determine the number of persons 
in the household were outside the definition of a census, and they were 
under no obligation to answer. 


The research revealed that for almost a century the census has 
been more than a simple head-count. Census data is used to calculate 
transfer payments to provinces, chart economic and social change, and 
forecast Canadian society's needs for schools, medical services and 
highways. Statistics Canada also sells aggregate data (stripped of 
personal identifiers and combined with the information of at least 100 
other individuals) in various electronic formats including CD-ROM, 
diskettes and magnetic tape. It is also testing making aggregate data 
available on Internet. 


Nevertheless, some perceive the questions as intrusive, 
particularly for the one in five who receive the long form. Given the 
personal nature of the data, the ability to link it to individuals, and its 
permanent storage, there were serious privacy issues. 
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The Office began a lengthy consultation with Statistics 
Canada; both parties were determined to deal with the privacy issues 
without bringing the census to a grinding halt. In an effort to reduce the 
intrusions, the 1996 census will omit the question about "person(s) living 
elsewhere who stayed overnight" from both short and long 
questionnaires. Questions about religion and fertility will be dropped from 
the long form and two questions about the respondent's dwelling will be 
eliminated from the short form which will now be limited to basic 
demographic information. 


To respond to the Commissioner's concern that the 
justification for many of the questions was unclear, Statistics Canada will 
also redesign the accompanying Guide, making it easier to read and 
explaining why the information is needed and how it will be used. It will 
also establish a Census Help Line during the census collection to answer 
the public's questions about confidentiality and privacy, as well as help 
callers complete the questionnaires. 


Security of the collection process 


To deal with complaints that Statistics Canada's collection 
procedure threatened respondents’ privacy, investigators examined 
census representatives’ oath of office, their hiring and training, as well as 
the procedures for collecting and handling census information. 


The 1991 census procedures did seem to pose risks to the 
security of the information. Statistics Canada's training of census 
representatives put inadequate emphasis on privacy protection principles 
or the public's growing privacy concerns. The agency agreed to expand 
these issues in training for the next census. 


Many complainants worried that neighbours serving as census 
representatives reviewed the completed questionnaires. The 
complainants had assumed that their answers would be reviewed bya 
faceless bureaucrat at Statistics Canada headquarters in Ottawa, not 
someone they knew. 
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Statistics Canada will try to reduce the chances of census 
representatives collecting information from someone they know by 
assigning them to enumeration areas outside their neighbourhood. This 
can be difficult in rural areas where the best way of ensuring all 
households are enumerated is assigning someone thoroughly familiar with 
the area. 


Although Statistics Canada will continue this process, it 
agreed to explain the role of census representatives clearly on both drop- 
off and mail-back envelopes. Respondents who do not want their 
information seen by the local representative can have someone else 
collect the completed return or mail it to the nearest regional office. 


Allowing census commissioners and representatives to work 
out of their homes also worried a number of complainants who thought 
the prospect of their completed forms on the family dining table seriously 
undermined the security of the collection. Statistics Canada provides 
specific instructions to census representatives on protecting the 
information they collect, and the agency is confident that the 
representatives are well aware of security responsibilities. 


The centralized edit test project 


An important project which could eliminate many of the 
collection irritants is Statistics Canada's test of a centralized edit 
collection for the 1996 census. In the test area (10 Ottawa-area electoral 
districts —400,000 individuals) all census questionnaires will be mailed 
directly to respondents who will then mail their completed forms to 
district offices for editing and follow up, rather than to the area census 
representative. 


This will eliminate door-to-door drop-off of the questionnaires, 
the need for census representatives and, therefore, the likelihood of 
neighbours reviewing completed questionnaires, as well as worries about 
security in representatives’ homes. 


Problems with missing or incomplete questionnaires which 
district office staff cannot resolve by telephone will be assigned to field 
representatives who are not local. This should reduce substantially the 
possibilities of having forms processed by a representative whom the 
respondent knows. 
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If this pilot project is successful, Statistics Canada intends to 
use It nationally in the 2001 census. 


Other complainants objected to having to share a single 
questionnaire with other household members. They argued that this 
effectively forced them to disclose information to others to whom they 
may not be related. Statistics Canada delivers only one form to keep 
collection and processing costs to a minimum. While most households do 
not need—and would probably protest—receiving separate questionnaires, 
Statistics Canada will offer individual questionnaires to anyone not 
wishing to share a form. 


In summary, the Office has persuaded Statistics Canada to 
make several significant changes to census collection to reduce the 


intrusion into Canadians’ personal lives. Those changes include: 


@ eliminating some of the questions from both short and long 
questionnaires; 


M@ simplifying the questionnaire and guide so respondents 
better understand the questions and why they are being asked; 


M@ employing, wherever possible, census representatives in 
areas where they are not likely to be known; 


M@ offering respondents the option to mail their completed 
questionnaire to a regional office so that local enumerators do 


not see their information; 


@ explaining clearly in the accompanying information the role 
of the local census representatives; 


@ training and sensitizing census employees to maintain the 
strictest principles of confidentiality and privacy in all phases 


of the census; 


@ modifying the edit and follow-up procedures to minimize the 
burden placed on respondents; 


M@ establishing a Census Help Line; and 


M@ testing the Centralized Edit System. 
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The best privacy solution—destruction 


One issue that is vital to Canadians’ long term privacy is the 
current procedure of keeping microfilm copies of completed census 
questionnaires and all other documents that link the responses with 
identifiable individuals. 


The Statistics Act absolutely prohibits Statistics Canada from 
disclosing personal census information to anyone for any reason. Records 
for censuses before and including 1901 are kept at the National Archives 
and are available for public research. But documents from all subsequent 
censuses remain under Statistics Canada control and no one outside that 
agency —not even the National Archivist—has access. 


The best privacy protection would be destruction of all 
personalized records from the 1991 census (as well as all other census 
records not already in the public domain) once Statistics Canada has 
processed the data to ensure its accuracy and quality. This solution 
would require Statistics Canada to seek an amendment to the census 
retention and disposal schedule approved by the National Archivist under 
the National Archives of Canada Act. 


While Statistics Canada is prepared to destroy the 1991 
records, National Archives officials are very reluctant. This issue will take 
time to resolve. 


However, should National Archives prevent Statistics Canada 
from destroying personalized census data, the Chief Statistician must 
notify Canadians that their personal data will be kept for indefinite 
storage, and eventually transferred to the National Archives. Canadians 
must know why the information is collected, how it will be used, how 
long it will be retained and to whom it will be disclosed. These are the 
principles at the heart of the Privacy Act, ones the government's most 
important personal data bank must live by. 


De-personalizing census data Is the critical element in 


achieving citizens’ full cooperation, as well as a permanent solution to 
recurring privacy concerns about the census. 
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Private detectives and "shadow" 
files—privacy at Canada Post 


A letter carrier's allegations about Canada Post's improper 
collection and disclosure of medical information and denial of access to 
health and employment records were serious enough. However, they 
were merely the tip of the iceberg. 


While searching the records, the investigator found evidence 
that Huron Division managers hired a private detective and put the 
employee under surveillance. The investigator also found a cabinet full of 
"shadow" files the manager maintained on employees which he 
considered his own property and not to be reviewed under the Privacy 
Act. 


The woman had fallen and hurt her back while delivering mail 
and made a Workers' Compensation claim. Despite having undergone 
back surgery, facing a second operation, and a consensus among her own 
surgeon and Canada Post-appointed doctors about the cause and extent 
of her injuries, managers doubted her compensation claim. They believed 
her injuries were caused by earlier car accidents and not the fall. They 
asked Corporate Security for authority to put her under surveillance 
outside working hours. They were refused. 


Frustrated, they hired a former postal inspector to conduct the 
surveillance, not only on the complainant but on two other employees 
who were also under management scrutiny. Although security officials 
denied any involvement, the investigator established that one of the staff 
knew the former postal inspector and recommended him to management 
to conduct the surveillance. 


The managers hired the detective (under the guise of other 
postal duties) to follow and photograph the complainant during her 
Compensation leave, hoping to prove her back injury was fabricated. 
When they were unsuccessful, they shredded what they thought was 
most of the evidence. However, the investigator found photocopies of 
the surveillance photographs in the Workers’ Compensation component of 
her Occupational Health, Safety and Environment (OHS&E) files. 
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OHS&E staff denied any knowledge of the surveillance and 
could not say how the photographs got there. Certainly, they were not 
there six months earlier when the woman was given access to what she 
thought was all her personal information. 


In fact, the investigator also discovered that she had not been 
given the entire 165-page Health Care component of the OHS&E files. 
Canada Post claimed the omission was inadvertent. However, this file 
contained most of the references to the surveillance. 


Canada Post attempted to continue withholding information 
about the surveillance from this file, claiming that releasing it would 
jeopardize a lawful investigation (section 22(1)(b)). The Commissioner 
rejected the exemption. 


The investigator also discovered that the complainant's 
manager in Huron Division had three large volumes—over 750 pages—of 
personal information concerning her employment, payroll, attendance, 
grievance, OHS&E and the requests for surveillance. Canada Post had 
not reviewed the material to respond to the woman's privacy request 
because the manager maintained that the files were his own personal 
property. Ultimately the manager was compelled to turn over the files 
which Canada Post processed and sent to the complainant. 


Other complaints about Canada Post's information handling 
were also justified, including OHS&E collecting medical information 
directly from the complainant's orthopaedic surgeon without her consent, 
and departmental officials failing to remove disciplinary documents from 
the complainant's employment files despite specific instructions in 
arbitration and grievance decisions. 


Canada Post headquarters’ officials acknowledged that 
managers kept their own personnel files for convenience but were 
unaware that Huron Division was conducting surveillance. They have 
stopped the abuse. The staff involved were either disciplined or removed, 
or have resigned. Canada Post wrote to the complainant to apologize for 
the surveillance and she has gained access to all the available material. 


Although there is only one "official" set of personnel files at 
Canada Post, many managers keep personnel records in their offices for 
administrative purposes. Canada Post's failure to review these records to 
respond to employees’ access requests is a source of repeated complaints 
to—and repeated reminders from—the Commissioner's Office. While 
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these files should mirror official files, employees wanting access should 
specify that they want all material searched — including any managers' 
files—just to be certain. 


The Privacy Commissioner considered all but two of the ie 
complaints well-founded. 


RCMP can notify employers of employees’ 
arrests—properly 


Three individuals complained that the RCMP improperly 
disclosed their arrests to their employers. 


In the first case, an RCMP officer disclosed details about the 
complainant's arrest to the Matsqui penitentiary where he worked. In the 
other case, a constable notified a bank manager that two of his 
employees had been arrested for shoplifting. 


The RCMP defended the officers’ actions, claiming it was in 
the public interest to ensure employers knew of employees' arrests and 
pending charges. The RCMP believed that the correctional employee's 
security clearance might be affected, and that the bank employees may 
have held positions of trust. 


Nevertheless, the Privacy Commissioner considered the 
complaints well-founded for several reasons. 


First, the RCMP failed to follow the procedure for public 
interest disclosures set out in the Privacy Act. Only the most senior 
officials in an agency should make the decision to release personal 
information "in the public interest", and then only after carefully weighing 
whether the public interest "clearly outweighs" any invasion of the 
individual's privacy. The government is also required to notify the Privacy 
Commissioner prior to the disclosure, giving him an Opportunity, if 
appropriate, to alert the person to the impending disclosure of their 
information. 
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Second, the RCMP has its own procedures for informing 
employers that employees’ actions may have undermined their reliability. 
They were not followed. Rather, staff in the local detachment made the 
determination without first obtaining approval from senior headquarters 
staff who are authorized to make such decisions. 


Third, in both instances, the information was not yet a matter 
of public record. Had detachment staff waited until charges were laid, 
the disclosure may have been allowed. 


Contractor refuses to turn over notes 


Recent annual reports have reminded departments not to 
contract out their privacy responsibilities when contracting out work. The 
contractor is simply an agent of the department. Any personal 
information it obtains or prepares belongs to the department and is 
protected by the Privacy Act. That means making it accessible to the 
person it concerns, protecting it from unauthorized disclosure, making it 
available to the department to audit contract compliance, and respecting 
retention and disposal criteria at the end of the contract. 


Despite repeated cautions, applicants continue to have 
difficulty getting access to personal information collected under contract. 


For example, a woman recently sought the Office's help to 
obtain supporting documents collected by a contractor hired by National 
Defence (DND) to investigate her complaint of sexual harassment. 
Although DND gave her a copy of the final report, it did not contain a list 
of witnesses interviewed, the questions asked, and their responses. 


The investigator found DND had no supporting documents. He 
asked DND to have the contractor turn over the documents in order to 
meet its obligation to provide the complainant access to her information. 
The contractor refused in order to protect the witnesses’ identities. 


The Commissioner was willing to pursue the matter but the 
complainant wanted no further action. Nevertheless, the Commissioner 
intends following up several similar outstanding complaints against DND 
(among others) and to obtain the contractors' documents for the 
complainants. The complaint was well-founded. 
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Elections Canada to end use of military 
numbers 


Two Canadian Armed Forces' members complained that their 
military service numbers had been included on mailing lists used by 
political candidates during the 1993 federal election Campaign. Both 
noticed that the mailing label on campaign literature from their local 
candidate included their service number. 


The investigator established that DND provided Elections 
Canada with the name, military number and postal address of all eligible 
CAF members under authority of the Canada Elections Act. Military 
members may select a permanent place of residence (often where they 
enlisted) or their current posting address. The Chief Electoral Officer 
must then provide this information to the returning officer of the selected 
riding, who makes it available to district candidates, on request. 


Since there is clear legislative authority for DND to disclose 
the military service numbers to Elections Canada, and for Elections 
Canada to disclose the numbers to political candidates, the complaint was 
not well-founded. Nevertheless, the Commissioner was concerned that 
providing military service numbers seemed an unnecessary invasion of 
privacy since Elections Canada acknowledged they were not absolutely 
required. Elections Canada agreed to seek an amendment to the Canada 
Elections Act to eliminate the need for DND to provide the number. This 
will be one of a number of amendments expected to be introduced during 
this session of Parliament. . 


Tenants' income revealed to justify rent 
subsidy 


Two complainants questioned why their housing cooperatives 
collected and then gave CMHC detailed information about their income in 
order to demonstrate that tenants were entitled to rent subsidies. 


The co-ops provide accommodation for low and moderate 
income families and individuals. Tenants who qualify for subsidy pay a 
percentage of their income as rent; CMHC pays the remainder. CMHC 
also helps finance a project's mortgage. 
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In one case, members of a Vancouver cooperative challenged 
the project's right to request copies of tenants’ income tax assessments. 
The project manager argued that the co-op needs sufficient proof of 
income to justify CMHC subsidizing tenants. Since there was some 
suspicion that some tenants were not reporting their true income, he 
argued that income tax assessments were the most prudent and 
reasonable means of verifying income. 


The second person complained that during an audit of a 
Scarborough, Ontario co-op, CMHC auditors took away a complete list of 
all tenants whose rent was in arrears, including the amount of arrears, as 
well as a printout of rent payments made by all tenants. 


CMHC enters agreements with non-profit groups to subsidize 
non-profit housing under the National Housing Act (NHA) and its 
regulations. The agreements require co-ops to gather information about 
the financial status of subsidized tenants to justify the CMHC subsidy and 
to maintain proper evidence to support CMHC's audits of tenant 
subsidies. 


The Commissioner concluded that CMHC was authorized by 
the NHA to obtain sufficient information (and relevant copies) about 
tenants and their income status to determine their qualifications for 
subsidy. The collection was a logical balance between the individual's 
right to privacy and CMHC's right to be satisfied that the financial 
assistance it was providing was justified and reasonable. The complaints 
were not well-founded. 


Immigration and Refugee Board needs 
immigration files 


An immigration lawyer questioned the amount of information 
Immigration and Refugee Board can legally obtain from Citizenship and 
Immigration Canada about applicants for refugee status. He also 
challenged the Board's powers to review information about other family 
members during its assessment of a claim. 


The Board demonstrated that assessing refugee claims is part 
of the overall immigration process and, as such, it has the right under the 
Immigration Act to review personal information collected by Immigration 
before deciding the refugee's claim. Exchanging personal information 
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with Immigration Canada is consistent with the purpose of the original 
collection and so meets the requirements of the Privacy Act. The Act 
prevents disclosing personal information without the individual's consent 
unless that is the original purpose or consistent with that collection. 


The Commissioner concluded that it was reasonable for the 
Board to consider information about other family members when 
reviewing an applicant's refugee claim. IRB must often verify information 
when, for example, a claimant is less than honest or the Board suspects 
the claimant is making multiple bogus refugee claims. 


The complaint was not well-founded. 


Balancing privacy and spiritual beliefs 


One of this year's complaints illustrated a potential clash of 
individual rights—the privacy rights of female correctional officers and the 
Spiritual beliefs of Aboriginal inmates. 


A Member of Parliament complained that one of his 
constituents, a corrections officer at the Saskatoon Regional Psychiatric 
Centre, had been asked to notify her supervisor when she was 
menstruating. The woman said that she had first been approached by 
two Aboriginal resource staff while she was guarding a sweat lodge 
ceremony during the first visit of a traditional healer. The resource staff 
explained that Aboriginal cultures believe a woman's menstrual period 
intensifies those powers normally associated with procreation. Proximity 
to these increased powers are believed harmful to men and sacred items 
in the sweat lodge. 


According to the complainant, when she told her supervisor 
about the incident, he asked her to advise the manager on shift when she 
was menstruating so she could be re-assigned. 


The investigator was unable to confirm either conversation. 
The resource staff denied having broached the subject with the woman. 
And the supervisor denied having asked for the information. He said he 
simply offered to have her report to a female manager and be assigned to 
other duties, should she want to respect Aboriginal beliefs. 
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Faced with contradictory statements and no witnesses, the 
investigator had to conclude there was no evidence to support the 
complainant's allegation that CSC had tried to collect information about 
her menses. There could well have been a misunderstanding; her 
supervisor's somewhat ambiguous response may have exacerbated the 
situation. It is obvious that any female employee would regard discussion 
of her menstrual cycle as a private matter and potentially offensive. 


Following the Office's investigation (and an internal 
investigation by the psychiatric centre) the centre issued a standing order 
advising staff about Aboriginal Offender Programs. The last item, entitled 
"Special Gifts of Woman Within Aboriginal Spiritual Beliefs" states: 


In order to show respect for and work with Aboriginal people, 
individual involvement and assignment of duties should be on 
a voluntary basis, where possible. 


The centre's executive director confirmed that female staff are not (and 
never have been) required to advise supervisors or anyone else about their 
menstrual cycle. 


The Commissioner concluded that there was no evidence to 
substantiate the complaint. 


Securing the tax phone line 


Occasionally callers do not wait for an improper disclosure but 
call to alert privacy staff to a potential problem. One case concerned 
Revenue Canada's automated Tax Information Phone Service (TIPS) 
which taxpayers can call for basic information about their return or 
refund. 


The complainant, an employer, was concerned that he, and 
presumably other employers, could call the TIPS line and get employees' 
tax details because they had the gate-keeping information—employees' 
social insurance numbers and dates of birth. The employer was 
prescient; another complainant had his identification stolen and 
subsequently used to obtain information from TIPS. 
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The investigator, armed only with a SIN and month and year of 
birth, called the TIPS number. She was able to confirm that an individual 
receives quarterly GST refunds and when the refund would be mailed, the 
individual's RRSP deduction limit for the filing year, and the amount of 
income tax refund owing. 


Clearly the TIPS gate-keeping measures were inadequate and 
more stringent protections were needed. 


Revenue Canada was reluctant to consider changes that would 
make the system more difficult for taxpayers to operate; TIPS is a 
convenient and cost-effective way to answer taxpayers’ most common 
questions—it handled more than two million last year. 


Revenue Canada rejected the Office's suggestion to assign 
taxpayers a personal identification number (PIN). It was too impractical 
and expensive—issuing PINs to every taxpayer would cost over 
$4,500,000 in mailing costs alone. Several other options for a third piece 
of identification were considered and rejected because the identifier was 
too easy to guess or was not collected in the tax database. 


The final proposal resolves the issue. TIPS callers will now be 
asked to provide their "total income" from line 150 of their tax return. 
Other callers would be unlikely to have this detail and it would be hard to 
guess or steal. 


Government shares tax, income and 
social benefit details 


Another complaint underscores the need for Canadians to 
understand that the federal government may disclose their information 
without their consent in a number of circumstances set out in the Privacy 
Act. While the Act controls federal government disclosures of personal 
information, it does not prevent departments from fulfilling their legal 
mandates nor shield individuals who are less than frank on their tax 
returns. 
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The widow of a Canadian war veteran complained that 
Revenue Canada disclosed her interest income to Income Security 
Programs which reduced her Old Age Security Spouse Allowance and 
Guaranteed Income Supplement. Income Security, in turn, gave the 
information to Veterans Affairs Canada which cancelled her Foreign War 
Disability Pension. 


The investigator confirmed the allegations were substantially 
correct. Income Security Programs did not contest the woman's claim. It 
routinely verifies Old Age Security applicants’ income with Revenue 
Canada, and it had disclosed the interest information to Veterans Affairs. 
Both departments demonstrated that the disclosures are authorized by 
law, and so comply with the Privacy Act which allows government 
institutions to disclose personal information if authorized by another law 
or regulation. 


In this case, Revenue Canada's disclosure to Income Security 
Programs is authorized by section 241 of the /ncome Tax Act, and 
Income Security Programs’ disclosure to Veterans Affairs by section 33 of 
the Old Age Security Act. 


The Commissioner considered the complaint not well-founded. 


New Customs lookout system "hits" on 
admin file 


A Nova Scotia man discovered why he was being stopped and 
sent for further questioning each time he crossed the Canada-U.S. 
border—his name was on the new Customs’ Primary Automated Lookout 
System. 


The lookout system includes names of individuals who have 
violated (or are suspected of violating) one of several statutes that 
Customs enforces at Canadian borders; for example, immigration, 
firearms and agriculture laws and regulations. Claiming that Revenue 
Canada improperly collected the information, he complained to the 
Commissioner. 
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Custom's lookout system shares selected information with the 
Police Information Retrieval System (PIRS), an RCMP data base containing 
information about events, subjects, vehicles and property. The RCMP 
system is available to other federal departments. Apparently the 
complainant had been implicated in an internal Agriculture Canada inquiry 
into allegations that staff were making personal use of departmental 
vehicles. Agriculture Canada put this information onto PIRS: whenever 
Customs officers queried his name at border-crossing points, the system 
showed a "hit". Believing there was an enforcement lookout for the man, 
they sent him for "secondary examination". 


Since Customs officers were merely responding to information 
Agriculture Canada put on PIRS, the focus of the investigation shifted to 
Agriculture. The investigator found that the new Customs lookout 
system had simply outpaced the programming of PIRS which could no 
longer distinguish between enforcement information (which Customs 
needed) and non-enforcement information, which it did not. 


To prevent future "hits" on the complainant, Agriculture 
Canada removed his information from PIRS. It will also stop entering non- 
enforcement information on the system and remove any that now exists. 
This should prevent other individuals being confronted with the same 
problem. 
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Inquiries 


The Office handled 9217 inquiries during the year, an increase 
of 529 from the previous year. 


Although two officers are assigned full-time to answering 
inquiries, the workload means that virtually all staff answer the public's 
questions. Staff provide details on the Privacy Act, the complaints 
process, basic information on privacy issues not in the Office's 
jurisdiction, and— where necessary —referrals to other government 
agencies and the private sector. Inquiries staff also do a preliminary 
assessment to determine whether the problem is within the 
Commissioner's jurisdiction and can be investigated. If so, they act as 
first level of intake for a complaint. 


The Visa Gold Card application 


More than 100 calls were prompted by a new Royal Bank Visa 
Gold application asking clients to allow the bank to use their Social 
Insurance Numbers (SINs) for a wide range of other services. The /ncome 
Tax Act requires customers to provide their SINs to financial institutions 
for interest statements. However, it also forbids financial institutions 
from using SINs for other purposes without the customer's consent. 
Unfortunately Royal Bank's request for consent is so broad that It 
constitutes a virtual waiver of the protection set out in the /ncome Tax 
Act. \t reads: 


If | have ever given you my social insurance 
number, you may treat it as Information and use it 
as an aid to identify me with credit bureaux and 
other parties. 


Even if | am no longer your client or this Agreement 
terminates, you may keep Information in your 
records and use it for the purpose noted above. 


The Commissioner discussed these blanket waivers in a recent 
appearance before the Senate Banking Committee which reviews the 
financial industry. Privacy of customers’ records is one of the issues the 
committee is examining, following changes to legislation governing banks, 
trust and insurance companies. 
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Putting personal data on the highway 


The hype (and confusion) Surrounding the information highway 
led to many callers wanting the Office's advice on how better to protect 
themselves in view of the lack of legal protection in the private sector. 
Staff can only offer general advice on transmitting any personal data by 
interactive networks: 


Ml assume the system is not secure unless the Carrier can 
prove to the contrary—don't transmit any personal information 
you're not prepared to have anyone know; 


M@ don't give out bank card numbers and financial information 
unless the system encrypts the information; 


M@ ask the operators of user groups how they store and use the 
personal details you supply to identify yourself as a legitimate 
user; are they secure? 


There were almost a 1000 calls about private companies 
posting employees’ overtime payments, SINs, home addresses and other 
personal information on bulletin boards. This may be insensitive but it is 
not against any law (with the possible exception of Quebec which has 
private sector privacy protection). Employees are advised to try to 
resolve the matter with human resources staff or with their union. 


Several callers complained that they were unable to access 


their medical or psychological files; these were referred to the Royal 
College of Physicians and Surgeons. 
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Monitoring Compliance 


The impact of federal government restructuring took affect 
with a vengeance this year. Following on the heels of the June 1993 
re-organization (reported last year) came Program Review—a fundamental 
re-examination of every federal program and activity (including more than 
400 agencies, boards and commissions), then the February 1995 budget. 
The result was closure of 73 agencies, streamlining 47 others and 
announced staff cuts of 45,000 employees— 20,000 by the summer of 
1996. 


Departmental staff who process personal information 
applications did not escape the cuts. But the workload had not 
diminished; it is simply spread among those who are left. The effect was 
predictable. Unable to meet the statutory deadline of 30 days to reply, 
departmental staff saw their application backlog mounting and a steady 
increase in delay complaints to the Privacy Commissioner. These delays 
are a factor in the Office's mounting complaint load. 


The scale of the changes left departments scrambling to 
redesign or integrate many informatics systems, move client and 
employee files to new homes, and decide how to store or dispose of 
personal records that no longer had a home. 


Reorganization also made following up earlier audits much 
more complex; recommendations that applied to old work units now had 
to be explained to managers who had inherited the programs (or lost them 
in the shuffle). For example, the Office of the Comptroller General, 
audited in 1992, merged with the Treasury Board Secretariat. TB and 
privacy staff had difficulty tracing files, and decisions concerning personal 
information that had been transferred. 
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Moving to a portfolio system 


The Office has had to reduce its dependence on routine audits 
to assess government compliance—the workload is simply beyond the 
four staff available for the task. Staff are now assigned as portfolio 
leaders to develop an understanding of the agencies' business and 
programs and to operate as a first line contact for government staff 
seeking advice. This more active stance should help prevent privacy 
problems in a department and even develop solutions government-wide. 


With the new portfolio system in place, the Commissioner 
wrote to all deputy heads outlining the Office's new approach and 
offering its services. The offer was taken up with a vengeance. Portfolio 
leaders met and briefed privacy coordinators representing more than 80 
federal agencies, as well as holding information sessions for more than 
400 employees, senior executives, technical experts, correctional staff 
and representatives of a private company working on a major re- 
engineering project. 


Responding to the requests proved a tall order for staff who 
received a constant stream of calls to explain the Act and Clarify policy 
and its application in various situations. 


Managers sometimes show little interest in privacy until they 
discover its impact on staff relations, informatics systems design and 
holdings, client and employee personal information, and information 
sharing projects with other departments, governments or the private 
sector. Once they understand the implications, they are only too glad to 
seek advice and forestall problems. 


Two examples dealt with during the year illustrate the 
advantage of examining issues government-wide; disposing of surplus 
(particularly computer) assets, and sharing personal information with 
other agencies and governments. 
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Disposing of surplus assets 


The saga of sloppy disposal of surplus assets continues. The 
1992-93 report told of a former office employee buying a surplus file 
cabinet and finding hundreds of file cards documenting individuals’ lab 
tests. Lightning struck again this year. The office bought a safe from a 
Crown Assets Distribution Centre and discovered several RCMP 
documents, including secret contingency plans and performance 
appraisals of senior RCMP members. 


In October, a man found used computer diskettes containing 
confidential information about a GST registrants in a file cabinet bought at 
a government surplus sale. These are just the federal government 
incidents in a litany of disclosures involving discarded cabinets, old 
computers and second-hand diskettes reported in the media. 


Pinning down responsibility for ensuring surplus cabinets, 
computers and diskettes are empty has not been easy. There has been a 
good deal of buck-passing. Getting concrete action to solve the problem 
has demanded the cooperation of Treasury Board, Crown Assets, the 
RCMP and departments themselves. The Office has pressed the major 
players steadily and now has an agreement. 


Who does what 


But first, here is how the responsibilities break down. Crown 
Assets is usually (but not always) the final gate before surplus material 
goes to market. However, it does not have enough staff to verify that all 
surplus goods have been emptied of sensitive information. That 
responsibility remains with the original owners. Frequently Crown Assets 
does not even see surplus desks or filing cabinets, serving simply as a 
clearing house to direct interested buyers to departments with available 
material. 
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The RCMP Security Engineering Section opens surplus safes, 
restores the combination to the factory setting and returns them to 
Crown Assets, which assumes they are clean and makes no further 
check. 


In addition, six departments are participating in a pilot project 
to dispose of their own surplus through trade-ins and interdepartmental 
transfers, without notifying Crown Assets. 


Finally, obsolete computers are sent to the Computers for 
Schools Program run by Industry Canada. Last year the program reported 
that about 95 per cent of all donated computers contained data and 
programs, despite government directives to clean computer disks. This 
year the news is better; 35 to 45 per cent of all donated federal 
computers were clean. Progress indeed but plenty of room for 
improvement—the remaining 55 to 65 per cent still represents a lot of 
government data. 


Now the agreement: 


M@ Crown Assets will amend the form on which federal 
institutions list sale items to require they certify the assets 
have been cleared of any sensitive or classified material. This 
is to be done for the July 1995 printing. 


@ Crown Assets will inform client departments about the 
change in flyers or newsletters, flag the changes to all 
distribution centres across Canada and amend its Customer 
Manual. 


@ Once the pilot electronic bulletin board system for 
government materiel managers is operational, it will include a 
permanent message reminding anyone trading or exchanging 
Surplus assets to ensure they have been emptied of any 
sensitive information. 
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lM The RCMP has sent bulletins to all departments describing 
an RCMP-approved utility which wipes all data from 
computers’ hard drives. The RCMP can only keep reminding 
staff that the hard drives of old computers should be 
completely erased. 


H@ Treasury Board Secretariat will write to all assistant deputy 
ministers asking them to ensure their departments have 
procedures in place to prevent any unauthorized disclosures of 
classified or designated information, including improper 
disclosures through the disposal of surplus assets. 


M@ Both the Board and Crown Assets agreed to publicize the 
issue through publications distributed to federal government 
material managers. 


The agreement will not necessarily spell the end of these 
careless disclosures. However, it should at least ensure that government 
agencies put the necessary safeguards in place and alert their employees 
to the dangers of improperly disposing of surplus assets. 


The federal government now needs to make similar efforts to 
ensure data cannot be retrieved from computer hard drives, tapes and 
diskettes which are damaged beyond repair. Sending hard disks to the 
local dump is not the answer; anyone with computer knowledge can 
extract some of the information. These media must also be purged of 
data or destroyed in such a way that they information cannot be 
retrieved. 


Sharing personal information— 
agreements and "arrangements" 


This year marked the Office's first attempt to maximize its use 
of its minimal audit resources by taking a "systemic" approach— 
reviewing one aspect of government handling of personal information 
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across all agencies. The issue is sharing client information with other 
programs or organizations. 


Knowing what personal information government shares, how, 
and with whom are fundamental to both individual citizens’ privacy rights 
and to the Commissioner's effective oversight. Although the Privacy Act 
prevents government from using personal information for purposes other 
than for which it was collected (section 7), it does set out a number of 
lawful disclosures (section 8). 


One of these allows a federal government agency to enter "an 
agreement or arrangement" to share information with the another 
government (or an organization of governments) to administer a law or 
carry out a lawful investigation. 


Treasury Board has published guidelines on information sharing 
agreements but not on what constitutes "an arrangement". And 
government departments are not required to notify the Privacy 
Commissioner when entering an agreement—as they are when conducting 
a data match. 


Early in 1995, the Office surveyed all 110 institutions subject 
to the Privacy Act to determine how much formal and informal sharing 
and data matching of personal information was taking place. The four- 
part questionnaire asked respondents to list all data matches and sharing 
agreements or arrangements both inside and outside the organization—93 
responded. 


The study revealed that 47 do not share personal data inside 
or outside the organization, two share internally, 17 share with outside 
organizations but not internally, 27 share both inside and outside, and 18 
reported data matches. 
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The second phase of the study will verify the data and 
examine selected agreements and arrangements. The Office will also 


develop guidelines and be better prepared to advise federal institutions on 
sharing information next year. 


Data matching 


Data matching is the technical process governments often use 
to share information. Essentially data matching compares information 
about individuals from different sources to make decisions about their 
benefits or services. Once conducted by sharing computer tapes, 
increasingly the trend is to allow other users—either other parts of the 
organization or other governments—direct access to on line data bases. 


A 1989 government policy requires government agencies to 
conduct detailed assessments of proposed data matches, and to notify 
the Privacy Commissioner. However, existing matches continue 
unreported; there is no mechanism to allow the Commissioner to gauge 
the scope of federal government data matching. 


The Office reviews data match proposals against the following 
criteria: 


M the information cannot be obtained by other methods; 


@ the collection relates directly to an operating program of the 
federal department; 


M@ direct collection would be counterproductive; 


@ the information will be accurate, up-to-date and complete, 
and 


M the benefits of the match clearly outweighs any subsequent 
invasion of privacy. 
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Three Human Resources programs 


Three recent cases at Human Resources Development Canada 
(HRD) illustrate how personal information is shared among federal, 
provincial and municipal governments to control abuse of federal 
unemployment insurance and provincial and municipal social benefit 
programs. 


Unemployment Insurance with Canada Pension Plan: HRD 
conducted a feasibility study to try to estimate losses from payments to 
individuals claiming both unemployment insurance and Canada Pension 
Plan disability benefits. (Anyone receiving CPP disability benefits is 
unable to work and therefore not entitled to unemployment insurance.) 
The study matched lists of those receiving benefits from both programs 
and estimated losses of more than $20 million a year. 


Following the study, HRD determined it was both feasible and 
cost effective to match the two data bases regularly, and submitted its 
data match assessment to the Privacy Commissioner. It was clear from 
the assessment and discussions with HRD staff that the benefits from the 
data match clearly outweighed any invasion of privacy. Clients sign a 
consent to verify the information on the application forms. 


Workers' Compensation with Unemployment Insurance: A 
second HRD study targeted individuals who were receiving benefits from 
both the Ontario Workers' Compensation Board and the Unemployment 
Insurance Program. This study also identified potential losses of over 
$20 million a year from overpayments. Following its assessment, Office 
Staff concluded that the benefits clearly outweighed the invasion of 
Privacy. 


The third case was not a data match but changes an existing 


information sharing procedure. Although not required to, HRD chose to 
consult the Office to forestall any problems. 
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Ontario social service with Unemployment Insurance: The 
change allows municipal social services staff direct access by dedicated 
computer terminals to limited personal data on HRD's unemployment 
insurance data base. This allows them to confirm that an applicant for 
social service benefits has applied for unemployment insurance. 
Provincial social assistance programs provide benefits to the needy to 
bridge the mandatory three-week waiting period for UI (and possibly two 
to three weeks to process the application). Applicants must sign an 
undertaking to repay any overlapping UI] payments to social services. 


Allowing social services staff direct access frees HRD staff 
from responding to numerous calls from social service staff, saves social 
services staff time and spares the applicant from travelling between two 
offices. 
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Notifying the Commissioner 


Reviewing public interest disclosures 


Overall, the number of disclosure notices rose slightly; 56 
compared to 48 last year. Some departments are beginning to use the 
disclosure provisions systematically. One of these is Correctional Service 
Canada which was responsible for 22 of the 56 disclosures reviewed this 
year. 


The vast majority of CSC's disclosures resulted from media 
requests under the Access to /nformation Act for internal reports on 
inmate escapes or violent incidents in penitentiaries. These reports 
usually contain personal information about inmates, victims and staff, and 
often discuss the factors determining the penitentiary in which the inmate 
is confined and the conditions of parole. 


Mounting public concern about sentencing and parole, 
particularly of dangerous offenders, is pressuring CSC to disclose all the 
factors it and the National Parole Board weigh in making these decisions. 
And whenever an incident occurs (for example, an inmate committing 
murder while on day parole), CSC considers that the public has a right to 
information which might have been a factor in the incident. Often this 
leads to disclosing a lot of sensitive personal information. Occasionally, 
in an effort to be open and accountable, the institution reaches too far. 


However, one lesson learned long ago is that privacy 
exemptions cannot be self-serving. CSC and NPB must not—and do 
not—exempt information that is critical of its or its employees' decisions 
or actions under the guise of protecting their privacy. 


The disclosure provisions require a delicate balancing act. 
“Public interest" is more than public Curiosity. The institution must 
demonstrate how this interest outweighs an individuals’ privacy rights. 
Even justified disclosures demand careful examination. 
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Investigating incidents 


Portfolio managers also investigated ten incidents leading to 
possible loss, theft or improper disclosure of personal information. 


Regular readers may note that most of past years' incidents 
appear to originate with a handful of institutions: Correctional Services 
Canada, the National Parole Board, Veterans Affairs Canada and Revenue 
Canada. This year is no exception. 


This does not mean other departments’ information 
management practices are so superior that they never lose, compromise 
or have personal information stolen. In fact, these organizations are 
among the few which take seriously their responsibility to advise the 
Commissioner that personal information may have been compromised. 
There is a positive side to notifying the Commissioner; it gives program 
staff an opportunity to enlist the Office's help in correcting—and 
ultimately preventing —a recurrence. 


CSC accounted for six of the 10 incident investigations 
opened by this Office in the year under review. All were caused by 
improperly handled personal information. 


Woman's name & address to inmate 


In one case, CSC wrote to a woman who was seeking 
information about a family member. Staff mistakenly put the letter in an 
envelope addressed to an inmate who is serving sentence for violent 
crimes against women in a penitentiary near the woman's home. 


Although the inmate will not be released for several years, 


privacy staff were concerned that the disclosure could seriously 
jeopardize the woman's safety. 
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CSC readily admitted its mistake. At the Office's urging, a 
CSC employee visited the woman to explain what had happened and to 
advise her about the situation. Apparently she was not unduly concerned 
and did not want CSC to take any further action. CSC will change its 
mailing procedures to prevent this happening again. 


SINs on envelopes 


One incident led to a number of complaints; Revenue Canada 
mailed a special tax guide to more than 700,000 taxpayers with their 
social insurance numbers (SIN) printed on the mailing label. 


The Office learned of the problem first from a journalist, then 
from several callers who received the package. The faulty labels had 
been fixed to special guides sent to taxpayers who reported rental income 
on last year's income tax returns, and to northern residents. The SIN 
(which is personal information) would have been visible to anyone 
handling the guide prior to delivery. Revenue Canada does not require the 
SIN to be displayed; the guides would reach the intended recipients 
without the SIN on the wrapper label. 


The investigators determined that three separate processing 
failures caused the disclosure. First, staff should have removed the SIN 
from computer tapes used to prepare the mailing list before sending it to 
the printer. Second, Revenue Canada did not specify precisely what 
information was to appear on the labels. Third, staff should have 
checked label samples before allowing the mailing. 


Revenue Canada recognizes its obligation to keep the SIN 


confidential. The deputy minister took a personal interest and the 
department quickly took steps to prevent a recurrence. 
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Audits and Follow-ups 


This year staff completed two major audits at Immigration and 
Consumer and Corporate Affairs (both of which have since been 
incorporated into new departments), as well as smaller audits of the 
Canada Council and both the Pacific and Atlantic Pilotage Authorities. 
This finishes work at the four pilotage authorities. 


Consumer and Corporate Affairs 


The Office has wrapped up the one remaining issue from its 
1993-94 audit of Consumer and Corporate Affairs Canada (CCA—now 
Industry Canada). In dispute were some of the contents of public records 
kept by the Superintendent of Bankruptcy. 


The Bankruptcy and Insolvency Act (BAA) requires the 
Superintendent to maintain a public registry of all insolvency 
proceedings—bankruptcy, proposal and receivership. In addition, some 
branch employees now act as Official Receivers; in effect the branch 
becomes the equivalent of a court of record. This means that certain 
documents dealing with these cases are considered public in the same 
manner as those filed in a court. 


Auditors reviewed a sampling of bankruptcy files and found 
that some contained a wide range of personal information, not only about 
the person declaring bankruptcy but also about family members and 
creditors. For example, some files included details about the person's use 
of alcohol or addiction to gambling; others, if the creditor was an 
individual, his or her home address, telephone number and Social 
Insurance Number. CCA staff could not define which elements of 
personal information were needed for the public register or records that 
are open for public inspection. 


J48, 


Establishing what constitutes a public record is critical since 
provisions of the Privacy Act dealing with an institution's use and 
disclosure of personal information (sections 7 and 8), do not apply to any 
"publicly available" information. 


The Superintendent examined the files and established a 
precise definition of which elements of personal information constitute 
the public register, and which documents are open for public inspection. 
The remaining personal details would have the full protection of the 
Privacy Act. 


The Commissioner accepted the new definition and 
recommended the Superintendent communicate them to all Bankruptcy 
staff and amend procedures to ensure that the remaining personal 
information in the files is protected. 


Immigration 


Privacy staff also completed auditing the Immigration Group of 
Employment and Immigration Canada during 1993-1994. However, they 
could not report the results and many outstanding issues owing to the 
upheaval surrounding its reorganization and integration into the new 
department of Citizenship and Immigration. 


The mandate of the audit was to examine the department's 
handling of employees' and clients’ personal information, including at a 
number of the department's approximately 900 regional offices. 
Immigration maintains personal information in 26 information banks on 
the 6.7 million individuals who have come to Canada since 1946. 


To process and store this information, the department has two 
major informatics systems, the Field Operations Support System (FOSS) 
and the Computerized Immigration Processing System (CIPS), as well as 
many sub-systems. The CIPS data is accessible in Canadian Visa Offices 
around the world. The department's current reorganization should have a 
Significant impact on management of its electronic records and files and 
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Office staff are approached regularly for advice on the privacy 
implications. 


Our auditors noted short-comings in some key areas, but given 


the "re-engineering" process, confined recommendations to the 
informatics systems. These recommendations include: 


on privacy 


@ incorporating a privacy alert in the software used to manage 
and transmit personal information between buildings; 


M incorporating commands in the software used to extract and 
print personal information from databases which will add a 
privacy statement to each printed document informing users 
about the requirements of the Privacy Act; 


M conducting a threat and risk assessment for all informatics 
systems and communications networks; 


@ arranging for SEIT (RCMP) inspection of informatics systems 
to assess the security status of these installations; 


@ establishing written criteria for granting access rights to the 
personal information contained in the informatics systems; 


@ incorporating an audit trail into informatics installations to 
allow managers to determine who has access to what personal 
information and for what purpose; 


M adding an encryption feature to all portable computers to 
protect the personal information they contain in case of lost or 
theft. 


The department invited the portfolio leader to provide advice 
issues to senior managers and staff during meetings on the 


re-engineering project. Next year's report will document the progress. 
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Pacific and Atlantic Pilotage Authorities 


These two pilotage authorities provide pilots to guide ocean- 
going vessels in Canadian waters. (The Laurentian and Great Lakes 
authorities were audited in 1991.) Most pilots are hired on contract and 
the authorities collect and manage very little personal information. Their 
files include information about pilots' certificates, medical information, 
and reports about any accidents in which pilots may have been involved. 
Files may also contain information on ship crew misconduct. 


Auditors recommended adding and amending bank descriptions 
in Info Source, improving notification to individuals about how the 
authorities’ use the personal information, and revising contracting-out 
procedures to address privacy concerns. Both Authorities have agreed to 
institute corrective measures. 


Canada Council 


The Canada Council provides funds and grants to artists, art 
professionals and artistic organizations to foster and promote the arts in 
Canada. It also acts as Secretariat for the Canadian Commission for 
UNESCO. The council creates an average of 15-20,000 files each year, 
almost all of which contain personal information. The holdings include 
basic data on artists, assessors and juries, and records from competitions 
and grant applications, including comments by assessors and juries on 
individual candidates. There is also a complete range of employee data. 


The audit was re-scheduled from the previous year at the 
council's request. Nevertheless, the council has undergone an extensive 
re-organization and down-sizing since the audit was conducted. 


The most significant recommendations concern the need for 


written policies and procedures on managing personal information and for 
Staff training about the requirements of the Privacy Act. 


LS 


Despite recent council efforts, staff are still not conversant 


with the concept of "personal information"; this deficiency is reflected in 
the protection council staff give personal information. 


The Commissioner made several recommendations concerning 


the council's collection, use, disclosure and protection of personal 
information. The council should 
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M@ develop a written policy and procedures on managing 
personal information and distribute them to staff and to 
external assessors who evaluate grant applications; 


@ review its collection procedures and forms and add a privacy 
rights statement to all those that do not yet have one; 


@ obtain explicit consent from individuals for using their names 
and other personal details for mailing lists; 


@ develop a written security policy and review practices which 
could compromise the confidentiality of its personal 
information holdings; 


M@ have the RCMP Systems Audit and Evaluation Investigation 
Team assess the security of the computer facilities; 


@ include privacy clauses in future contracts with outside 
organizations, stipulating that any personal information 
collected or generated is the exclusive property of the council; 


@ issue specific instructions on secure disposal of computer 
equipment and storage media before discarding or selling; 


@ prevent staff of other organizations with whom it shares 
facilities from accessing personal information in data bases or 
storage media; 


@ instruct staff on the use of laptop computers outside council 
premises when the hard disk contains personal information, 
and equip each laptop with a security device, and 


M@ complete an index of all personal information holdings and 
mailing lists and review the /nfo Source listing to ensure their 
accuracy. 


Follow-ups 


This year staff continued following up earlier audits to 
determine whether the organizations had implemented the 
Commissioner's recommendations. Portfolio leaders reviewed audits of 9 
institutions and found 37 of 39 recommendations (95 per cent) had been 
completely implemented, a significantly higher proportion than last year's 
77 per cent. One recommendation had been partially implemented. One 
other finding is no longer applicable. 


Staff reviewed Telefilm Canada, Transportation Safety Board 
of Canada, Canadian International Trade Tribunal, Office of the Chief 
Electoral Officer, Canada Deposit Insurance Corporation, Veterans Affairs 
Canada, Veterans Appeal Board, Bureau of Pensions Advocates and the 
Office of the Comptroller General. 


The organizations have responded to all recommendations 
about increasing staff awareness. One had also developed a policy 
concerning the secure transmission of personal information by fax. 
Another dedicated a new printer to its human resources unit, placing it in 
a secure area to prevent other staff from seeing personnel information. 


Approximately half of the organizations reviewed need to 
change their retention and disposal practices to comply with the Privacy 
Act. All but one of these have submitted retention and disposal 
schedules for National Archives approval. One department conducts 
random spot checks to ensure that no sensitive material is sent for 
recycling. 
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Auditors often find that the information bank listings in /nfo 
Source are inadequate or non-existent. This year was no exception. 
Recommendations were made to all organizations except the 
Transportation Safety Board to edit, add or amend their listings. The 
organizations have complied. 


Keeping /nfo Source listings accurate and up-to-date is key to 
individuals exercising their access and correction rights. Incomplete or 
inaccurate listings mean the government is not meeting a fundamental 
obligation under the Privacy Act—to spell out what information it collects 
and how the data is used and disclosed. 


Office of the Chief Electoral Officer 


In November 1994, the Office completed follow-up of its 1992 
audit of the Office of the Chief Electoral Officer (Elections Canada). 
Elections Canada organizes federal elections and referenda and compiles 
the federal electors list. Elections Canada has acted on 10 of the 11 
recommendations contained in the report, including both administrative 
changes and amendments to the Canada Elections Act. 


The one outstanding recommendation concerns RCMP review 
of Elections Canada's EDP system security. Although it has put additional 
EDP controls in place, its systems have yet to be reviewed by the 
Security Evaluation and Inspection Team to ensure they conform to 
accepted security practices. Elections Canada assured the Commissioner 
that the review would occur in the near future. System security is critical 
given Elections Canada's project to develop a permanent voters’ list. 


The permanent voters' register 
The idea of a permanent voters register was first discussed in 
1988. It would replace the costly and time-consuming door-to-door 


enumeration, problems exacerbated by urban Canadians' growing concern 
with providing information to strangers at the door. 
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Given the obvious Privacy concerns with a permanent 
electronic register, the Commissioner accepted Elections Canada's 
invitation to participate in a working group studying the feasibility of a 
register to be used in all federal, provincial and municipal elections. 
Privacy staff would provide advice on such privacy pitfalls as whether the 
information would be collected from other electronic databases—and 
how, who would have access to the register, its security and the 
accuracy and completeness of the data. 
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Corporate Management 


The Information and Privacy Commissioners share premises 
and administrative services for economy and efficiency but operate 
independently under their separate statutory authorities. Corporate 
Management provides centralized administrative services to avoid 
duplicating effort and to realize cost savings to the government. The 
services include finance, personnel, information technology advice and 
support, and general administration (including records management, 
security, procurement, library, reception and management services). 


The Branch is a frugal operation with 14 staff (who perform a 
variety of tasks) and a budget accounting for just 15 per cent of the 
overall OIPC budget. While the Branch will continue to improve 
productivity, it is at that precarious line between being lean and what the 
Privacy Commissioner has described as "fiscal anorexia". 


Resource information 


The Offices' combined budget for the 1994-95 fiscal year was 
$6,696,000, a decrease of $123,000 over 1993-94. Actual 
expenditures for the 1994-95 period were $6,522,356 of which, 
personnel costs of $5,300,465 and professional and special services 
expenditures of $584,559 accounted for more that 90 per cent of all 
expenditures. The remaining $637,332 covered all other expenditures 
including postage, telecommunications service, office equipment and 
supplies. 
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Expenditure details are reflected in figure 1 (resources by 
rganization/activity) and figure 2, (details by object of expenditure). 


Figure 1: 1994-95 Resources by 


Organization/Activity 


HUMAN RESOURCES 


FINANCIAL RESOURCES 
(FULL-TIME EQUIVALENTS) ($000) 


Information 
31 (387%) 


Information 
2674 (41%) 


Administration 
1949 (15%) 


Administration 
15 (18%) Privacy 
2899 (44%) 


Privacy 
38 (45%) 


Figure 2: Details by Object of Expenditure 


= essere 


Information Privacy Corporate Total 
Management 

alaries 1,820,590" (2,252,850 587,020 4,660,465 
mployee Benefit Plan Contributions 255,000 299,000 86,000 640,000 
ransportation and Communication 58,653 78,470 106,272 243,395 
formation 44,182 74,436 2,754 121,372 
rofessional and Special Services 345,823 134,371 104,365 584,559 
entals 25,323 589 12,883 38,795 
urchased Repair and Maintenance Ast aS 9,559 Boro 36,000 
tilities, Materials And Supplies 25,026 21,195 31,494 78,015 
Cquisition of Machinery and 75,010 27,260 12,906 115,682 
JUuipment 
ther Payments 2.871 845 357 4,073 


a A SSI a cae ce 2 ea ck a 
otal 2,674,407 2,898,575 949,374 6,522,356 


sess eS 


Expenditure Figures do not incorporate final year-end adjustments reflected in 
the Offices' 1994-95 Public Accounts. 
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Dear Mr. Molgat: 


I have the honour to submit to Parliament my annual report which covers the 
period from April 1, 1995 to March 31, 1996. 


Yours sincerely, 
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Privacy Commissaire 
Commissioner a la protection de 
of Canada la vie privée du Canada 


The Honourable Gilbert Parent 
The Speaker 


The House of Commons 
Ottawa 


July 1996 


Dear Mr. Parent: 


I have the honour to submit to Parliament my annual report which covers the 
period from April 1, 1995 to March 31, 1996. 


Yours sincerely, 


iy 


Bruce Phillips 
Privacy Commissioner 


A Day in the Life...or how to help build your 
Super File 


Nothing to hide? It's just as well...from the time we get up in the morning until 
we climb into bed at night we leave a trail of data behind us for others to collect, 
merge, analyse, massage and even sell—often without our knowledge or consent. 
And there is no law against it (except in Quebec). 


8:30 Exit apartment parking lot (Cameras, and possibly a card, record 
departure) 

8:35 Pull onto toll highway (Device records your entry and exit points 
to send bill at the end of the month) 

8:42 Caught in traffic jam, call work to delay meeting (Cellular phone 


calls can be easily intercepted; new personal telephones will signal 
your whereabouts to satellites to deliver calls) 


O17 Enter office parking lot (Card records entry and time, cameras 
monitor garage) 

9:20 Enter main office/plant door ("Swipe" cards record comings and 
goings; active badges allow others to locate you anywhere in the 
building) 

225 Log on to computer (System records time in) 

9:29 Send personal E-mail to friend, business message to colleague 


(Both can be read by the employer; simple deletion does not erase 
them from the computer's hard drive) 

10:45 Call your mother (Supervisors may monitor phone calls) 

11:00 Make a delivery using company vehicle (Many company vehicles 
have geo-positioning devices to plot vehicle location; some have 
"black boxes" to record driving habits) 


12:05 Stop at bank machine (System records details of transactions, 
cameras overhead or in machine record your behaviour) 
12:10 Buy birthday gift for friend (Credit card records details of 


purchase, retailer's loyalty card profiles purchase for points and 
directed discounts; banks may use spending patterns to help assemble 
complete customer profile) 

12:35 Doctor's appointment (Health cards will soon contain small 
computer chips to record your complete medical history on the card, 
blood samples contain DNA which could be tested for wide variety 
of conditions, doctor's diagnosis may need to be disclosed to 
insurance company if you buy life or disability insurance and details 
sent to centralized registry in U.S run by insurance companies) 


7320 


8:20 


8:30 


8:35 


8:45 


9:10 


Pick up prescription (Some provinces have on-line drug networks 
which share your drug history with pharmacies across the province 
and may be disclosed to police tracking drug abuse) 

Return to work (Card records your return) 

Provide urine sample for employer's new drug testing program 
(Reveals use of targetted drugs but not impairment; sample may also 
reveal use of legal drugs such as birth control pills, insulin and anti- 
depressants) 

Meeting in secure area (Pass through security which scans retina to 
confirm identity) 

Complete first draft of report (Computer records content, can also 
store keyboard speed, error rate, length of pauses and absences) 
Leave office (Exit recorded by computer, entry system and parking 
lot) 

Buy groceries (Debit card purchase recorded, loyalty card tracks 
selections for marketing and targeted discounts) 

Pick up video (Computer records viewing preferences, Social 
Insurance Number; store may sell your viewing preferences—say, 
Erotica—to other companies) 

Listen to phone messages (Your phone has recorded callers' phone 
numbers, displays your number when you call others—unless you 
enter code to block the display) 

Order clothing from catalogue (Company records personal details 
and credit card number and may sell the information to 
database—list—marketers) 

Subscribe to new magazine (Many magazines routinely sell their 
subscribers’ list to mass mailers) 

Survey company calls (Company gathers political views, social 
attitudes and personal views. Some surveys are actually marketing 
calls to collect personal data for future sales. Legitimate surveys 
destroy personal identifiers once data processed) 

Political canvasser at the door (Political contributions of more than 
$100—amounts and the party—are listed in public records) 

Log onto Internet (Your choice of chat groups and your messages 
can be monitored and a profile assembled by anyone, including 
police; some Web sites monitor your visits); see Privacy in 
Cyberspace p.27. 


Increasingly, living a modern urban life seems to mean there is nowhere to hide. 
In our search for security and convenience, are we hitching ourselves to an 
electronic leash? 


Highlights 


Canadians' privacy protection weakening as government sells off operations 
with no binding privacy clauses (page 1); 


Under construction: permanent voters list—some warning markers around 


the potholes (page 14); 

Violent offenders in the community—is publicity the answer? (page 22); 
Privacy in Cyberspace—tips for surfers (page 27); 

A framework for introducing multi-function smart cards (page 8); 


1681 complaints investigated, more than 9000 inquiries handled (page 33). 
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Mixed Messages 


‘Necessity is the plea for every infringement of human freedom. It is the argument of 
tyrants; ut 1s the creed of slaves."—William Pitt the Younger, 1793. 


The great British parliamentarian's words, uttered more than 200 years ago, have 
never been more relevant, timely or applicable than they are in today's struggle 
to hang on to our right to a private life. 


Society, in the throes of an unparalleled technological revolution, is confronted 
daily by arguments that yet another infringement of our personal freedom is 
necessary, the usual necessity being those seductive benefits: efficiency, 
convenience and economy. Sometimes the benefit is real; sometimes it is merely 
promised, not proven; often it is mostly for the efficiency, convenience and 
profit of its proponents. 


Yet if there is a tyrant, it is not some jackbooted dictator. It is the tyranny of 
ignorance, of unthinking acceptance of technology without regard to the 
consequences. The tyrant and the slave are one and the same. It is ourselves. 


A Backward Leap 


Sadly the struggle—thought to have been largely won in the public 
sector—sulfered a body blow this past year. Thousands of Canadians lost their 
rights under the Privacy Act as the federal government began downsizing and 
privatizing. Information previously collected by government entities will soon 
be moved from under the protection of the Privacy Act and into the control of 
private companies. This means that innumerable bits of personal data no longer 
will have to be managed in accordance with fair information practices; the 
subjects of all this information will have no legal right of access to the 
information and no legal control over what information is collected about them, 
how it may be used, disclosed or otherwise disposed of. 


Most immediately, commercialization affects the thousands of federal government 
employees who are transferring to the private sector. But equally important, it 
touches the untold numbers of Canadians who use services previously managed 
by government. 


This constitutes nothing less than a privacy disaster, and is a dark stain on the 
otherwise progressive record of the Canadian government in protecting 
Canadians’ privacy rights. This consequence of privatization may have been 
entirely unintended; it can hardly have been unforeseen. And, regrettably, it was 
entirely preventable. 


The issue arose in dramatic fashion during the transfer of the air traffic control 
system to a private company, NAVCANADA. An estimated 6,000 federal 
employees will move from government to private employment. As well, the air 
traffic control system generates substantial personal information in its contacts 
with thousands of users of the system. 


Given the magnitude of the transfer, the Commissioner wrote to the government 
last November pointing out the consequences to privacy protection and offering 
a solution. He suggested inserting a condition to the agreement between the 
government and NAVCANADA making the company subject to the Privacy 
Act, as it is subject to the Official Languages Act. 


Although the government conceded the importance of the issue, it took no 
action. The Commissioner then appeared before the Commons Transport 
Committee studying the transfer. The committee accepted the proposal and 
recommended it to the House of Commons. The government objected to the 
recommendation and, despite a further intervention before the Senate committee, 
the bill has now cleared both Houses with no privacy protection. 


Among the objections put forward both by NAVCANADA and the 
government, foremost was the contention that binding NAVCANADA to the 
Privacy Act would single it out for special treatment by a government which 
otherwise has not enforced privacy law in the commercial sector. There is ample 
precedent. 


It is government policy to recommend that contracts between government 
departments and outside service providers contain clauses extending Privacy Act 
protection to any personal data. Furthermore, at least one huge enterprise, 
Canada Post, was required to abide by the Privacy Act when its corporate 
structure was revamped and its mandate altered to make it operate in the manner 
of a private sector, profit-and-loss corporation. Although owned by government, 
Canada Post must compete in the open market for much of its business. This is 
not a problem NAVCANADA, a monopoly, will ever face. 


Whatever one makes of these arguments, the government has an obligation not 
to sacrifice basic rights such as privacy and data protection as it commercializes 
operations, particularly when the available defence is as simple as insisting on a 
privacy clause. It is worth pointing out that one of the chief government 


negotiators publicly stated that Privacy Act protection would not have been a 
"deal-breaker". 


As for the company, NAVCANADA has undertaken to seek employees’ consent 
for transferring personal files and to keep the records confidential "pursuant to 
government policy". Fine words but not ones that convey any legal rights, and 
far from the protection they now enjoy. The Office intends to audit the 
personal records before Transport Canada transfers them to NAVCANADA, 


Canada's air traffic control system is simply one of several operations to be 
commercialized. Next on the block is Canada Communications Group, the 
government's massive printing, distribution and inquiries operation. Already 
gone are the harbours and many airports. And in the works are a new breed of 
‘service agencies" to provide selected services of existing government insitutions. 
These include Parks Canada (formerly Environment Canada), a single food 
inspection agency (Agri-Food Canada) and the Canada Revenue Commissjon 
(Revenue Canada). These new agencies will be given greater autonomy to 
improve service and reduce costs and have more flexibility to allow provincial 
Participation. At issue is whether "streamlined rules and flexible authorities" and 
separate legislation also spell the end of privacy protection for clients and 
employees. 


"Twixt Darkness and Dawn" 

The light at the end of this murky tunnel may be the news contained in the 
government's response to the recommendations of the Information Highway 
Advisory Council. Perhaps saving the best for last, Industry Minister John 
Manley announced the most important privacy development of recent years, and 
potentially the most important in Canadian history: the federal government's 
commitment to introduce legislation bringing the commercial world under the 
ambit of privacy laws. 


The report, Moving Canada into the 21st Century, acknowledges that when it 
comes to protecting personal information in an information society, "security 
procedures and technologies cannot do the job alone. The right to privacy must 
be recognized in law, especially in an electronic world of private databases where 
it 1s all too easy to collect and exploit information about individual citizens". 


The ministers of Industry and Justice undertook to consult with the provinces 
"and other stakeholders" and bring forward proposals for "a legislative 
framework governing the protection of personal data in the private sector". 


Here, at last, is at least the prospect of meaningful action. 


To meet the threats to privacy posed by the information revolution, nothing 
equals the need for bringing order, fairness and decency to the information 


management practices of the private sector. This is where most personal 
information is collected and used, and this is where there is the least protection 
for, and recognition of the rights of individuals. 


The government, in developing this framework legislation, has the opportunity 
to build on what may be a growing consensus for action. One early indication 
of support came in the Canadian Direct Marketing Association's brave 
announcement of support for legislation to protect personal data in the private 
sector. In CDMA President John Gustavson's words "legislation is the most 
effective means of ensuring all private sector organizations adhere to the same 
basic set of rules..."._ And the trail has already been substantially blazed by the 
Canadian Standards Association's now-final model privacy code. The code was 
drafted with major private sector players such as the banks and telecom- 
munications companies and contains all the essential elements for good privacy 


protection save independent oversight and the force of law. 


Mr. Manley's announcement included no details, for the good and obvious reason 
that the work is just beginning. As usual, the devil is in the details. The 
government can bring forward truly effective legislation, heralding a new dawn 
in which technology follows a path lighted by civilized standards of respect for 
the rights of human beings. Or, if the action is excessively timid or, as is so 
often the case, the bold initial thrust is emasculated by concessions to special 
interests, we will find ourselves mired in the grip of ineffectual patchwork laws 
with little ahead but a gathering gloom of greater surveillance and less control 
over what others know about us. Such an outcome would be worse than no 
action at all, deluding us, as it would, with a mere illusion of protection. 


So Canadian society finds itself at a critical point, where its privacy is poised 
between salvation and sinking. Everything now depends on the will and 
creativity of governments and Parliament. 


Toward a new birth of civility 

Although we have placed great emphasis on the need for better privacy laws, 
laws alone are not the answer. They are merely the written expression and 
refinement of a social consensus of fundamental dos and don'ts—those ethical 
principles on which we build common values and our individual and collective 
behaviour. Breathing life into our laws demands a climate of broadly-accepted 
ethical principles, a sort of ethical glue. It is ttme we took a hard look at the 
ethical issues raised by new technology. 


Any casual perusal of the daily press demonstrates that our ethical glue is losing | 
its sticking power. Look only at the chaos of hacking, unauthorized access into , 


private and personal computer files, systems pranks and vandalism, software 
piracy, electronic harassment and bulletin boards of hate, pornography and 
violence. In short, technology has thrust us into the information age but we 
have arrived having given little thought to our social responsibilities. 


We seem to suffer a stunning inability to put the pursuit of human dignity at the 
heart of our development and Progress. It is not enough that new technology 
satisfy material needs. It must also play its part in affirming human dignity and 
human potential. Otherwise, we are conducting a technical exercise in a moral 
vacuum—moulding our lives to fit technology, not making technology fit our 
lives. 


Social responsibility in the electronic world is everyone's business. It is 
maintaining the delicate balance between meeting legitimate information needs 
and simply respecting people, their property and their rights. We can no 
longer—if we ever could—afford to do things simply because we have the 
technical capacity. We must dedicate time and resources to the process of 
discerning ethical dimensions and integrating ethical decisions into the technology 
design process. We must educate young people about the rules of morality, 
civility and mutual respect in cyberspace. Our enthusiasm and expectations will 
be pointless if we simply become more technically adept but not more learned, 
thoughtful and considerate. In short, we must build an ethical foundation for 
technology. 


It all comes down to the degree to which we respect one another as unique 
individuals, each with our own set of values, which we are entitled to conceal or 
reveal as we choose. To truly respect your neighbour, you must grant that 
person a private life. The limits of our personal privacy define in large part the 
limits of our freedom. As Supreme Court Justice La Forest put it in a 1990 
decision "...not to be compelled to share our confidences with others is the very 
hallmark of a free society". If we discard the notion of privacy and simply treat 
one another as data subjects, as objects of surveillance, we abandon that 
fundamental, democratic notion of autonomy and self-determination. 


Let us be clear. No amount of information or technology will do much good 
unless we consider the values it serves. | 


Of Ethics and Smart Cards 


ID card stories are standard fare for Privacy Commissioners’ annual reports. 
This year's menu is rich. Governments’ appetite to cut spending, simplify and 
privatize program delivery, and to ferret out cheats, has led to a plethora of 
proposals most of which are supported by new, glitzy technologies. 


The key component of these proposals is often a multi-purpose ID card or a 
smart card which looks like the pieces of plastic found in most wallets. 
However, imbedded in them are powerful microchips and circuitry which allow 
the collection, storage and manipulation of vast amounts of data. The cards can 
be inserted into electronic readers and operate like a personal computer plugged 
into a network. They are low cost, versatile, simple and powerful; hence their 
attraction. They are yet another intriguing new option for bureaucrats and 
private sector administrators to deliver programs more efficiently and more 
cheaply for our benefit and their profit. As journalist John Ibbitson described 
them in a recent Ottawa Citizen article, they are fast becoming a "plastic 
panacea". 


Improperly applied, these technologies can be powerful surveillance tools, 
delivering the fatal blow to an already fragile and embattled right. Those who 
consider the fears exaggerated need look no further than the quoted words of the 
Ontario Cabinet Minister on Ontario's plan to introduce a multi-purpose smart 
card. This proposed card would replace existing driver's licences, health and 
welfare cards and keep a timely record of citizen's use of the system " ... like 
Visa or Mastercard where they can tell you where you were an hour ago and 
how much you spent, that would be a great step forward for the health system 
in Ontario". Perhaps a great step forward for efficient administration of the 
health care system, but certainly a giant leap backwards for autonomy and 
privacy. 


Toronto's welfare card 

An example of the efficiency and the surveillance capacity offered by smart card 
technology is the Metro Toronto proposal for welfare recipients to carry cards 
containing a digitized fingerprint. The fingerprint is not a conventional inked 
impression but a picture transformed into an encrypted numerical code (known 
as a "biocrypt"). Welfare claimants would be required to produce their cards to 
claim a service. A reader will scan the biocrypt to ensure it matches the code 
imbedded in the card. The system allows the code to be stored only on the card 
thus allowing the claimant to retain control. 


i 
| 


The downside is that welfare payments could be credited to a card which can 
then be used for direct debits at stores. While it is clear the present proposal will 
not track the behaviour of people, it would be a simple matter, once 
implemented, for the system to collect information about the life styles and the 
spending habits of welfare recipients. There is an added human cost which is to 
require a segment of the population to be monitored in a way, usually reserved 
for criminals, that no other citizens have to suffer. The data may also prove to 
be attractive to social science researchers. Officials estimate that the cards will 
save $32-million from the annual $1.1-billion cost of operating the welfare system 
by eliminating claimants collecting more than one cheque. 


A similar proposal in B.C. using laser photo smart cards would merge drivers' 
licences, welfare cards and health cards. B.C. Privacy Commissioner David 
Flaherty termed the proposal an invasion of privacy, and the B.C. Civil Liberties 
Association considered it acceptable only if used for identification purposes. 


The SmartHealth process 

The prairie provinces have all considered switching to smart card technology to 
deliver health care services, hoping that stricter monitoring and control of patient 
claims and health practitioners’ billings will lead to savings. One early example 
is Manitoba's proposal for a Health Information Network to exchange patients’ 
health care information throughout the health care system and make it available 
for research. The province awarded a contract to SmartHealth, owned by the 
Royal Bank of Canada, to examine the proposal. 


Manitoba's approach illustrates how best to use the technology; first define the 
needs and then look for the technology solution. SmartHealth conducted 
numerous focus groups, surveys and interviews and found "among the most cited 
concerns were fears of personal health information falling into the wrong hands". 
Manitoba has concluded that privacy safeguards must be in place before the 
network is developed; it will then select the most appropriate technology for the 
task. A smart card is simply one of the options. 


However, Manitoba's proposal also illustrates what is a growing (and potentially 
alarming) trend to deliver government services in partnership with the private 
sector. Personal information now largely protected by privacy rules will be 
shared with the private sector which is subject to no privacy laws and 
increasingly anxious not to be. Private sector "opting in" to voluntary privacy 
codes is a grossly inadequate trade-off for gaining access to data and transactions 
which now have legal protection. | 


There is also a ray of hope in a Québec proposal to introduce smart card 
technology as part of the government's information highway strategy. Like 
other provinces, Quebec's multi-purpose smart card would replace existing 
government identification cards. Unlike some other proposals, however, the 
Québec card would be used for all program delivery, including such things as 
hunting and fishing licences. The most important difference lies in the 
government's stated intention to measure technological initiatives against three 
fundamental principles: universal and equitable access, privacy and the 
confidentiality of personal information, and respect for existing social values. 


The project could well build on the province's experience with a pilot project to 
introduce a health smart card in Rimouski. In his report on the the pilot 
project, Quebec Privacy Commissioner Paul-Andre Comeau observed 


",..the success of the project (was) due first and foremost to the guarantees of 
confidentiality offered by project designers and the choice of of a technology 
able to ensure confidentiality...". 


Smart cards have the potential to destroy our privacy or to enhance it. We can 
use them as a powerful surveillance tool to monitor and control individuals; or 
we can use them, not only as a device to protect the security and confidentiality 
of our personal data, but also as a device that will allow us to exercise a greater 
degree of control over uses and disclosures of our personal information. Should 
our lives fit technology or technology fit our lives? Ultimately the choice is ours. 


A Privacy Framework for Smart Cards 


The Privacy Act sets out the ground rules for federal government collection, use, 
disclosure and protection of personal information and establishes a commissioner 
as independent oversight of government compliance with the law. Since smart 
cards are potentially major data collection, storage and disclosure tools, the Office 
proposes a framework to ensure that government institutions take privacy and 
other ethical principles into account in the applications design phase of smart 
cards. We welcome readers' comments and suggestions. 


Is the collection related to a government program? 
The Privacy Act requires that government institutions collect no personal 
information unless it relates directly to an operating program or activity. 


Regulatory/legislative framework: To show a direct relation to an 
operating program or activity, an institution must ordinarily demonstrate 
that it has Parliamentary authority to collect the information. Thus, some 
legal mechanism (legislation or regulation) should govern each smart card 
system whether for client services or program delivery. These should specify 


not only the technical and administrative characteristics of program delivery 
but also the ethical codes which will govern privacy, confidentiality and 
security. 


Is the information collected directly from the individual and he or she 
notified of the purpose? 

The Privacy Act generally requires that personal information be collected directly 
from the individual and the individual informed of the purpose for collection. 


Public notice of systems: In the broadest sense, government should alert the 
public to the system's development—for example, its objectives, extent, the 
type of data and clients affected—before the system is implemented. 


Individual written notification: The government should provide each card 
holder, in writing, the essential information about program participation and 
use of the card. This includes details about the purpose, nature, operation of 
the system, contents of the card, and the individuals authorized to access it 
(either read or record). 


Government should also inform card holders of all possible communications 
between the issuer (the government agency) and the card users (the service 
provider/point of delivery of that program). 


How long will the information be kept? 
The Privacy Act requires government to prescribe retention spans for personal 
information. 


Data conservation: Card issuers and users must establish retention and 
disposal schemes for data. Issuers should establish regulations governing the 
nature of information conserved and the security measures taken to guarantee 
confidentiality of the data. 


How will accuracy of the information be ensured? 
The Privacy Act requires a government institution to take all reasonable steps to 
ensure that personal information is as accurate, up-to-date and complete as 


possible. 


Responsibility for inaccurate information: Card users should not 
automatically accept the accuracy of the information simply because it is 
recorded on the card—the data could be false, incomplete or obsolete. 
Accuracy 1s a joint responsibility of the card issuer, card user and card 


holder. 


How will the information be destroyed? 
The Privacy Act requires that disposal of personal information be regulated to 
ensure the data can no longer be used or improperly disclosed. 


Card renewal: Government must establish which data from old cards should 
be transferred to the new card; and whether old data should be rendered 
anonymous and available for research purposes. 


Destruction of the card: Subject to the regulatory authority governing 
destruction of the card, individuals should have the right to request that the 
card be destroyed; this would include rendering anonymous all data stored 
by the card issuer about the card and its contents. 


How will the data be used and disclosed? 
The Privacy Act sets out principles of fair information practices governing how 
personal information may be used or disclosed. 
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Reading the card: Government must determine who it will authorize to 
read the card, the extent of authorization (total or partial), and the protocols 
governing the reading function. 


Restricting reading access or use for other purposes: Government must 
establish conditions and measures to prevent unauthorized access to card files 
or uses other than those originally intended. Access must be restricted only 
to those who have an authorized need-to-know under the Privacy Act. 


Restricting unauthorized use, disclosure and copying: Government must 
institute proper controls to prevent card users from unauthorized down- 
loading of information from the smart card to other databases and then using 
it for purposes unknown to the card holder. 


All non-government card users or readers must operate under regulatory 
restrictions by agreement with the government program authority and have 
no automatic rights to copy other data from the card—this must be subject to 
the card holder's authorization. 


Card structure: The card chip should be structured in different zones of 
access to assure selective or limited degrees of access as well as segregation of 
identification data, administrative data, and sensitive data such as medical or 
emergency help information. 


Government should segregate each application on the card to prevent 
merging or cross-overs of data. Readers and public point-of-delivery devices 
must secure transactions to and from the host computer. 


Individual authorization for reading access: The file contents of the card 
shall not be accessed by third parties except by a positive act of the card 


holder (or by the card holder's authorized agent, as in a medical emergency). 
Such positive action would generally be punching in a PIN or other code. 


Entering/removing information on the card: Government must determine 
who may enter, change or delete data on a card, either directly or through 
the delivery authority. Issuers must consider the individual's right to 
demand erasure of parts of information on the data card from every 
institution that makes entries. 


Visible data on the card surface: The card exterior should contain only the 
minimum amount of nominative information required for the purposes of 
program participation. 


Do individuals have right of access to the personal data? 
The Privacy Act gives individuals the right of access to personal information 
about them. 


Transparency of data on the card: Individual card holders must be able to 
know the type of information held on the card. 


Right of card holder to read the file: Government should provide 
individuals the means to read their own cards. They should also be prepared 
to interpret the data for card holders. 


Data entry/transaction record: Card issuers and users must compile and 
maintain a record of all significant data entries as well as all communications 
between them concerning the card holder. These records should also be 
available to the card holder. 


This suggested framework is based on the privacy checklist for technology set 
out in the Commissioner's 1992-93 annual report (see page 14). 


To obtain copies of the complete text of the Privacy Framework for Smart Card 


Applications, or to submit your comments, please contact the Office or visit our 


Web site. 
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Building a DNA Database—Carefully 


Last year we reported our recommendations on the proposed bill to allow police 
to obtain DNA samples from a person suspected of a serious crime. The law 
was enacted in July 1995. 


However, the legislation did not deal with several privacy issues, the most 
important of which was whether to establish a database of genetic samples or 
analyses derived from those samples. Early in 1996, the Solicitor General issued 
a consultation document, Establishing a National DNA Databank, that dealt with 
many of the remaining privacy issues. Our response made several proposals: 


e samples should be taken for the database only after the person has been 
convicted (as opposed to samples taken during an investigation to prove the 
crime in question). For the "less serious" of these serious offences, a judicial 
warrant would be needed to acquire the sample for the database. For the 
more serious offences, taking the sample would be automatic; 


e once the analysis of a sample appears on the database, either automatically or 
by judicial warrant, the police should be permitted access to the database 
whenever they have DNA evidence from a crime scene that may match a 
sample taken for the database; 


e only the forensic analysis of DNA samples taken from convicted offenders 
should be kept, not the actual samples. Discarding the actual samples would 
prevent unrelated secondary uses, including ethically problematic research 
into genetic links to crime; 


e volunteered samples for a criminal investigation (for example, when the 
police appeal to a community to volunteer DNA to help track down a 
violent criminal) should be used only for the investigation of the offence in 
question; the samples and the analysis of the samples should be destroyed 
immediately after the donors are exonerated; 


e DNA identification information on the database should not be kept 
indefinitely. It should be destroyed when it is no longer needed—for 
example, after the offender has died or after sufficient time has passed 
(perhaps decades in some cases) and the offender is not likely to reoffend; 


e legislation establishing a DNA database should provide for a review of the 
database operation within two to three years of the legislation coming into 
force. The review would include a privacy audit. | 


The privacy audit is particularly important. Two or three years experience with 
the database should give a good idea of its utility in solving crimes. It will also 
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help to ensure that the database does not become subject to “function creep". 
We want to avoid an ever-lengthening list of offences for which a DNA database 
or DNA sampling in criminal investigations is allowed. The pressure to do just 
that is already present in our society, a product of the very existence of tech- 
nology and the belief that technology can solve all our woes, if only we let it. 


Legislation dealing with these remaining aspects of forensic DNA analysis has yet 
to be introduced in Parliament. We await any such proposed legislation to 
ensure that it meets our criteria. 


As a final note on this subject, we commend both the Department of Justice and 
the Ministry of the Solicitor General for recognizing privacy issues as among the 
most significant in the discussion of forensic DNA sampling and DNA databases. 
We also commend them for involving our office in the consultation process 
before legislation is introduced. Their willingness to discuss the privacy issues 
with our office ensures a hearing at a time when changes can be accommodated 
with little political embarrassment. 


15 


A Vote for Privacy? 


Canada's Chief Electoral Officer recently proposed amendments to the Canada 
Elections Act which would give him authority to create a permanent voters 
register. The notion is not new. It was considered, but not recommended, by 
the 1991 Royal Commission on electoral reform. Canadians have traditionally 
resisted such proposals because population registers pose a potential threat to 
human rights and freedom. Wartime memories are etched in the minds of many. 


Political climates change, however. In the age of "fiscal responsibility", what was 
previously unacceptable is now fashionable on condition that millions of dollars 
can be trimmed from public expenses. Québec and British Colombia have 
recently created permanent voters registers citing budget reductions and 
efficiency. The federal government now proposes to follow suit. "Efficiency, 
economy and accuracy" is the rallying cry; there are other equally important 
considerations. 


The proposal 

Elections Canada proposed to create the permanent register from one last 
traditional door-to-door enumeration. Enumerators would collect the name, 
address, sex, date of birth, telephone number, and confirm citizenship of 
potential voters. The Chief Electoral Officer would also have the authority to 
collect additional information if necessary. Once collected and validated, the data 
would be stored in an automated database. Individuals would not have to 
register and could have their names removed at any time. 


Elections Canada also proposed to conduct periodic data matches with other 
government data bases such as tax and motor vehicle records to update addresses; 
with vital statistics to remove the names of deceased persons; with citizenship 
records to add new Canadians entitled to vote, and with provincial election lists 
after elections to update the data. 


Provinces, municipalities and school boards could obtain information from the 
register to conduct local elections. And every year all members of Parliament 
would receive the list of voters in their respective constituencies. 


The response 

It is both laudable, and consistent with existing Privacy Act rules, to begin by 
direct individual enumeration. This gives citizens the opportunity to decide 
whether to be included on the list and to provide the information directly. 
However, there are several concerns. 
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Telephone numbers The Office questioned the proposal to collect a new data 
element—telephone numbers. Telephone numbers are not needed now and their 
appearance on a voters’ list would seem to beg intrusive calls. Elections Canada 
explained that the numbers will be used only for internal administrative purposes 
and will not be included on the lists. 


Power to collect more data The provision allowing the Chief Electoral Officer 
to collect additional information aroused some early concern, opening the 
door—as it seemed—to a broader collection than legislators may intend. The 
provision is simply to permit the federal agency to collect additional personal 
details if required by provincial election laws. The Chief Electoral Officer 
undertook to make this clear in the legislation. 


Annual disclosure of lists to legislators Annual disclosures of the list appears 
excessive in light of the list's express purpose of conducting elections or 
referenda. Given that no jurisdiction conducts annual elections, this frequent a 
disclosure seems more suited to repeated canvassing by political parties, not the 
election itself. The Chief Electoral Officer agreed to re-examine the need for 
annual disclosures. 


Collection by data matching Updating the register by data matches with other 
federal data banks is worrisome. On principle, the Commissioner opposes 
mining other government databases for unrelated uses. Datamatching is invisible 
and inconsistent with the federal Privacy Act. The preferred method is for 
Elections Canada to collect the information directly from the Canadian public, 
with their knowledge and consent. 


The Commissioner suggested that Elections Canada arrange to include a consent 
box on other federal government forms to authorize departments like Revenue 
Canada or Human Resources Development Canada to transmit the personal data. 
British Columbia uses this system to maintain its electors' register. Or Elections 
Canada could develop a specific form to be enclosed in all government mailings 
and returned directly to Elections Canada. The Chief Electoral Officer 
undertook to pursue the idea. 


Other uses of the list By far the greatest concern is pressure for secondary uses 
of the register. It will be a very attractive list of the majority of Canadian 
citizens and hold enormous potential for any number of public organizations. 
Other levels of government which have created permanent registers have found 
that requests for access by other government programs soon follow. These are 
difficult to resist. Growing authorized access to Revenue Canada's list of tax 
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filers—once virtually off-limits—leads one to suspect that the voters' register will 
soon be targeted. 


The Chief Electoral Officer explained that requests for access to the list for any 
unrelated purposes—which the Commissioner would strenuously oppose—would 
require Parliamentary approval and thus be a matter for public debate. 


The bottom line 


The best conceivable privacy protection is resisting the temptation to administer 
a program by assembling vast amounts of personal information in an automated 
data base. If it is impossible to design an electoral process without such a 
collection—and Canadians accept the necessity of a permanent voters 
register—then the following conditions must be met: 


e limit the personal information collection to those details needed for 
Canadians to exercise their right to vote; 


e collect the information directly from citizens—with their knowledge and 
consent; 


e limit uses of the register to those required for Canadians to exercise their 
right to vote, and 


e prohibit disclosures of personal information from the register unless to 
conduct federal, provincial, municipal or school board elections—and then 
only where equal legal privacy protection exists. 
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And the Walls Come Tumbling Down 


Early in 1994, Treasury Board Secretariat tabled its Blueprint for Renewing 
Government Services Using Information Technology. The blueprint responded to 
the federal government's call for a leaner and more efficient public service, 
encouraging every federal institution to use computer technology to streamline 
operations and eliminate inefficiencies. 


Given the impact of several of the Blueprint recommendations on government 
handling of personal records, the Office asked to be involved in projects which 
federal institutions undertake. While more than 30 federal institutions have since” 
begun re-examining their operations, two departments have taken a clear lead. 
Both have approached us for guidance. 


Citizenship & Immigration Canada CIC's Business Process Re-engineering 1s 
the first major Blueprint initiative, one which other departments are viewing as a 
test project. CIC aims to become a "horizontally-integrated" work environment 
which means sharing more information about immigrants and refugee claimants 
both inside and outside CIC. CIC now segregates data according to its purpose 
or program (the vertical or "stovepipe" information environment common to 
most federal institutions). CIC has begun the transition to a horizontal 
environment which will integrate all its information resources. 


Human Resources Development Canada (HRDC) is the other leader. 
HRDC 1s streamlining its delivery of employment insurance, Canada Pension 
Plan, workforce training and job bank programs and substantially reducing the 
number of Canada Employment Centres. HRD will deliver service to many 
communities by satellite and telephone centres, electronic kiosks, frequently in 
partnership with private businesses, Crown Corporations, special agencies or 
provincial and municipal governments. 


The two initiatives illustrate two government trends and, if not properly 
planned, the risks they pose. They are data warehousing and shared service 
delivery. 


Data warehousing 

Perhaps the most significant development in government information 
management is the steady move toward departments developing so-called "data 
warehouses" to store and manipulate all their program data—including, of course, 
personal information used to make decisions about individuals. Human 
Resources Canada and Veterans Affairs Canada are just two of the institutions 
that are developing data warehouses. 
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A data warehouse is a sort of super repository which integrates data from a 
variety of sources, reconciles any anomalies, then makes it easily accessible for 
search, analysis and manipulation. Rather than segmenting the data by its 
intended use—for example, paying taxes, claiming Canada Pension Plan, or 
applying for a student loan—all the data is organized by the person's name and 
other personal identifiers. Find the individual and you have a record of all their 
transactions with the federal government. 


For managers, the prospect is exciting. For privacy, it is troubling. Data 
warehouses, by definition, consolidate information thus making more details 
accessible to more people. Personal information collected for one purpose could 
become available for different and unrelated purposes. 


And consolidation pushes demand for even more information—the data 
warehouse as insatiable appetite. This is what privacy advocates call "function 
creep". Warehousing data also permits the creation of client profiles—or more 
insidious—"client intimacy" systems drawn from historical transactions and 
relationships previously unknown. 


Ultimately, the system demands a unique identifier to link to the individual's 
data file. Thus we arrive at the single number, single file, single card without 
which we are no-one. Like all advanced systems, the data risks becoming 
paramount, not the person; we are all reduced to bits and bytes. 


Technological advances are undermining individual control over personal 
information. They may even be undermining privacy laws because protecting 
privacy becomes increasingly difficult as systems become more developed, more 
widespread and more complex. 


That does not justify throwing up our hands. Nor does it justify the angry 
outbursts that privacy is the impediment to new systems development. The 
accusation that something cannot be done because of privacy is more often 
simply an excuse offered at the end of the systems development cycle; an attempt 
to assign blame elsewhere for not having done the work properly at the outset. 


The accusation is simply wrong and short-sighted. Privacy does not restrict good 
systems design—it enhances it. Systems designers simply have to build in 
controls to limit employees' access to the data elements necessary to deliver the 
program or service. Privacy protection is an essential component of good 
information management and a good systems development plan; one which helps 
ensure public confidence in government's computer based systems. It's time to 
get on with it. 
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Shared Service Delivery 

The second administrative trend with privacy implications is sharing service 
delivery points with other federal agencies, with other levels of government, and 
perhaps even private sector operators. The concept could be a boon to 
citizens—one-stop-shopping for municipal taxes, drivers' licenses, UI benefits and 
Canada Student Loan applications. But the privacy problems are evident. How 
will several levels of government protect the individual's records? Will the data 
and terminals be separate? Are the records under the "control" of the federal 
government, subject to the provincial privacy law or, if the centre is operated by 
the private sector—by contract compliance? Or will it be unprotected? 


As with data warehousing, shared service delivery must be done with great care. 
If we are going to share services with provincial or municipal governments, we 
must make the obligations of various parties clear at the outset. And the answer 
is not sinking to the lowest level of privacy protection—in some jurisdictions, 
that is virtually none. 


Much as the Office lauds federal government efforts to become more efficient, 
there are real privacy concerns with horizontal integration and shared service 
delivery. While our work with CIC and HRDC has allayed some fears, 
Blueprint initiatives may well create the unique on-line client file designed to be 
shared by federal, provincial, private or even foreign organizations who may need 
access. 


Not only is this incompatible with the current Privacy Act, it raises the spectre of 
a surveillance society; one in which anyone will be able to learn anything about 
anybody. We have yet to confront two unavoidable realities: no computer 
system in the world has yet proven safe from hackers, and the weakest link in 
any computer system is the authorized users. 
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This Year's Telecom News 


While technology may (and, occasionally, may not) enhance our quality of life, 
there is little doubt that it can have a dark side for privacy. Even its creators 
often do not fully understand the potential, let alone the users. Privacy is 
sometimes a victim of entrepreneurship, and this year's technological headline 
may again prove the point. 


Personal Communications Systems 

In December 1995 Industry Canada licensed four companies to offer Personal 
Communications Services (PCS). The small, hand-held devices, which can 
transmit voice, data, graphics and video, operate on separate frequencies from 
cellular telephones, relying on digital—rather than analog—transmission. Digital 
networks offer cheaper, better and more secure transmission and the increased 
ability to send text and images. 


Given PCS marked improvement over cellular telephony, what is the problem? 
There are two of which Canadians should be aware. 


First, PCS communications are still transmitted over the airways and so can be 
intercepted, albeit with more sophisticated and more expensive equipment. 
Second, PCS service must know your exact location at all times—at home, on the 
ski slope or in a shopping mall—to deliver calls. Unsettling enough, but its 
power to locate the user also makes it a tempting tool for criminals, law 
enforcement agencies, jealous spouses or direct marketers. 


These two problems could be addressed by 


® encrypting transmissions—this would provide sufficient protection for most 
users. Of course, encrypted communications can sometimed be deciphered, 
witness the recent breach of Netscape's Internet browser encryption 
algorithm; 


e "locking" the handset so that the user requires a personal access code. 


Industry Canada plans to limit the use of digital scanners, thus reducing the 
chance for interception of PCS communication. But another needed step is to 
prohibit PCS companies from either using or disclosing information about the 
subscriber's whereabouts for any purpose other than routing calls or billing PCS 
service. And PCS invoices should not display the exact location of a calling or 
called party. 
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Although the Canadian Radio-television and Telecommunications Commission 
(CRTC) does not now regulate PCS companies, it will hold public hearings later 
this year to determine which, if any, aspects of wireless telecommunications 


(including PCS) it will regulate. 


If both manufacturers and regulators would safeguard the handset, the 
transmissions and the records, Canadians wil] reap only the intended benefits, 
not find themselves under surveillance from another piece of electronic wizardry 
designed to ease their lives 


Other telecommunications news 

_De-regulating conventional telephone service has opened several cans of worms, 
some of these concern the right of competing companies to have access to the 
customer lists of full-service telephone companies. One immediate impact of 
disclosure of customer data to long-distance re-sellers was a blizzard of mail and 
marketing calls, and in some cases, clients being switched to other companies 
without their knowledge or consent. 


The CRTC authorizes the full service companies to disclose their customer data 
to long distance resellers on request and with proof of the customer's interest. 
However, the re-sellers (which buy blocks of long distance calls from the 
telephone companies) are not regulated by the CRTC and some customers have 
been unaware of the switch until receiving their first bill. Customers can be 
returned to their original provider at no cost. More recently, private directory 
publishers have asked the CRTC for access to electronic client lists to publish 
directories, now published mainly by Tele-Direct, a Bell Canada subsidiary. 


While the CRTC agreed that White Directory could compete against existing 
directory publishers, it ordered telephone companies to enable subscribers to 
remove their names and addresses from the electronic directory files before they 
were given to White Directory. White Directory appealed the "de-listing" 
mechanism to the CRTC, arguing that it would be at an immediate disadvantage 
because its directories would likely contain fewer listings than current directories, 
should many subscribers opt out. The CRTC upheld its earlier decision and 
White Directory filed a petition with the Governor in Council seeking to 
overturn the CRTC order. 


The Privacy Commissioner supported the CRTC decision and urged to the 
Governor in Council to guarantee subscribers the right to full control over their 
personal information. The Governor in Council has up to one year to make a 
decision. 
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One Size Does Not Fit All 


There appears to be a growing public outcry about releasing violent offenders 
into the community either on parole or at the end of their sentence. The 
concern is most acute with pedophiles. There is no doubt that some danger 
exists and Canadians have the right to try to minimize those dangers. An 
incident in Fort St. John, B.C. illustrates. 


Fort St. John City Council, told that a known sex-offender was in the 
community, agreed to help local community groups print and distribute posters 
publicizing the man's presence. At a later meeting the Council resolved to pass 
on the information to other communities in B.C., Yukon and Alberta. The 
poster contained a photograph, physical description, list of convictions, as well as 
a notation about withdrawn charges. During the storm of publicity, the man left 
the community. 


Both B.C. Information and Privacy Commissioner David Flaherty and this 
Office inquired—Dr. Flaherty into the actions of the municipality, and this 
Office into an allegation that the RCMP improperly disclosed information to the 
mayor of Fort St. John (information which actually appeared to be publicly 
available). Both commissioners concluded that while disclosure may be 
appropriate in some circumstances, the "shotgun approach", as Dr. Flaherty 
describes it, is often not the answer. Both agreed that a consistent national 
policy and process would help officials determine when disclosure is needed. 


In an effort to shed some light on a heated discussion, the Office produced a 
discussion paper entitled Publicizing the identity of violent offenders on their release 
into the community. 


Protecting the public from violent offenders is primarily the responsibility of the 
criminal justice system, mental health institutions and social welfare agencies. It 
is not usually a privacy issue. However, in part because the justice system is 
fallible and prison rehabilitation programs sometimes ineffectual, governments 
and the public look to other means of protection. 


Is publicity the answer? 

Publicity is becoming the cheap "solution" to a complex problem caused partly 
by structural weaknesses in the correctional system. Publicity also means 
governments are disclosing personal information about offenders without their 
consent. It is these disclosures that have drawn federal and provincial privacy 
commissioners into the debate. 
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Notifying the public about the presence of a violent offender may prevent 
further harm in some cases. However, publicity may actually produce greater 
harms: 


e publicity may drive some offenders underground and away from treatment, 
making them more dangerous; 


e publicity may give the community a false sense of security that all dangerous 
offenders have been identified, when in fact most likely have not; 


° publicity may make it impossible for a released offender to remain in a 
community, thus hurting chances for successful reintegration into society; 


¢ since many violent offenders will not reoffend, disclosing information about 
them may unjustifiably harm them; and 


® unwarranted publicity may threaten the physical safety of offenders, often 
with no consequential benefit to society. 


From a privacy perspective, any measures that warrant breaching the offender's 
privacy should have a demonstrable public benefit. If there is no benefit, there 
should be no disclosure. Two questions need answering: When is it appropriate 
to release personal information about an offender who has left an institution on 
parole, under statutory remission, or at the end of the sentence? Who should 
have authority to release the information, and to whom? 


The discussion paper examines several possible disclosure programs for releasing 
violent offenders into the community. Among them are those used in B.C. and 
Manitoba. Both programs involve the interested parties—police, correctional 
officials and, in Manitoba, public interest groups—in examining the circumstances 
of an offender and then deciding whether disclosure is warranted and if so, to 
what extent. 


Privacy Act does not prevent release 

All too often officials claim that the federal Privacy Act prevents them from 
releasing personal information that would identify a pedophile or other 
dangerous offender in a community—even if it might serve the public interest to 
do so. 


This is not so. The Privacy Act's prohibition against disclosure of personal 
information may be overridden if the head of the government institution 
concludes that there is a demonstrable public interest. The head must then 
notify the Commissioner's Office. Staff examine the circumstances leading to the 
disclosure proposal and the type of disclosure. The Commissioner then decides 
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whether to notify the individual about the disclosure; however, the 
Commissioner has no authority to stop the release. 


To repeat this oft-misunderstood point: The Privacy Commissioner has no 
power—other than that of persuasion—over releasing information about a 
potentially dangerous offender to the public. The Privacy Commissioner neither 
initiates or prevents the release. If anything, the Privacy Act provides rules to 
facilitate the release of personal information in the public interest. 


Striking the balance 

There is no easy solution to these complex issue of protecting society against 
dangerous human behaviour. To determine whether disclosure may help to 
resolve the problem, we recommend establishing a process to assess the factors. 
Among the factors that need assessing are the risk that the person will re-offend, 
the ability of measures other than publicity to reduce the threat, the possible 
harms that may flow from publicity—both to the community and the 
offender—and the extent of any publicity that is warranted. 


The schemes used in B.C. and Manitoba appear reasonable models for striking a 
balance between the public interest in knowing the presence of a potentially 
dangerous person and that person's right of privacy. Our discussion paper offers 
tentative support for such schemes for any offender who poses a certain level of 
risk of serious violence to the community, not merely sex offenders. For 
provinces that do not have such schemes, a federally appointed government/lay 
committee could make recommendations to the RCMP, Correctional Service 
Canada and the National Parole Board about disclosure in the public interest. 


Copies of the discussion paper will be available from the Office and on our Web 
site. 
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Refining the Criminal Records System 


A criminal history records system is a vital tool for police forces and other 
agencies which investigate and prevent crime. This powerful and sensitive record 
collection is maintained by the RCMP in its information bank CMP PPU 030, 
Criminal History Records and Identification Fingerprints. The database is 
subject to the Privacy Act and during the past year Office staff completed a study 
of its contents and administration. 


The study helped dispel a number of misconceptions that had developed about 
what information is contained in criminal history records and how it is managed. 
The RCMP is aware of the sensitivity of this personal information, of the need 
to ensure it is accurate and up-to-date, and of its responsibilities to properly 
manage the information. Interviews with members of the RCMP and other 
police forces helped confirm that the RCMP makes every possible effort to 
ensure the information is accessible only to individuals and organizations who 
need to know. 


Although the RCMP's overall management of the information continues to 
respect the Privacy Act, staff identified several Opportunities to strengthen 
compliance. They include the following issues: 


Mandate Although the study identified a number of pieces of legislation that 
refer to the RCMP's maintenance of criminal history records, neither Office or 
RCMP staff were able to identify a comprehensive authority. Since the 
information is used daily by police agencies and other organizations to make 
significant decisions about individuals, specific legislation or amendments to 
existing legislation would better serve the interests of both the RCMP and the 
Canadian public. The legislation should spell out what information may be 
collected, how it may be used and to whom it may be disclosed. 


Content of Criminal History Records The current definition of criminal 
history includes not only charges for which an individual has been convicted, but 
also charges stayed, withdrawn or for which the individual was found not guilty. 
Although information about charges for which an accused was not convicted can 
be valuable to police forces, it should be held in a separate information bank to 
which access is more limited. This would ensure it would be available only for 
authorized police investigations and not for such other uses as screening 
employees. Since the 1987 Ministerial Directive on disclosure of criminal history 
information is being revised, the time seems right to consider creating a second 
bank for records for which there was no conviction. 
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Cessation of Pardon The Criminal Records Act provides the National Parole 
Board with the power to revoke a pardon after giving the individual an 
opportunity to make representations. 


The Act also provides that a pardon ceases if an individual is subsequently 
convicted of an indictable or hybrid offence. In these cases, the Act requires the 
RCMFP to restore all entries concerning the pardoned offences into the regular 
criminal records system. The individual has no opportunity to make 
representations or to be advised that the pardon has ceased. This may lead the 
accused to believe that information once inaccessible because of the pardon, is 
once again available for use against the individual. 


The RCMP should modify its procedures to include notifying the individual, 


whenever possible, that pardon has been revoked, thus making the system much 


more open to everyone concerned. 


Info Source Description The RCMP's criminal history records do not always 
contain an individual's complete criminal history because police and correctional 
agencies are not obliged to provide information to the system. The bank 
description in Info Source is unclear and could lead readers to conclude that the 
bank is a complete history of all criminal charges and convictions. The RCMP 
should amend the bank description to describe the information more accurately. 


Printed copies of the Study of Criminal History Records Maintained by the RCMP 
can be ordered from the Office or obtained from our Web site. 
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Privacy in Cyberspace—a surfer's guide 


At last count (or best guesstimate) 40 million people worldwide are surfing the 
Net for fun and profit. Surprisingly, many of them are simply unaware that 
their communications, transactions—and perhaps even the data on their own 
computer—are available for others to see (unless they take precautions). 


The openness of the Internet should not be surprising—the Net evolved from a 
U.S. Defence Department communications network (ARPANET) linking 
military bases, university research centers and defence contractors. It was 
designed to be open and accessible—to communicate and to be impervious to 
nuclear attack. Other computer networks and universities quickly joined. 


Today the Net is multiple networks with many pathways connecting many 
computers. Messages can be routed around the world to reach across town and 
seldom travel the same route twice. The Net resides nowhere and everywhere; it 
has no headquarters and no-one is "in charge". That is its power—and its 
challenge to privacy. 


Sitting quietly in front of our personal computers, it's easy to be lulled into 
forgetting that sending E-mail is not like making a telephone call; it's more like 
broadcasting. We should have few expectations of privacy. In fact, not only are 
our messages to public newsgroups or forums accessible to others, software 
available on the Net allows others to assemble a profile of our messages and 
interests. Soon marketers will systematically mine the Net to assemble personal 
profiles and target lists to sell products and services on line. And shopping and 
banking over the Net pose their own risks unless the service is protected by 
encryption. 


The power and reach of the Internet gives users and system operators 
extraordinary access to data, including personal information. In January 1989 the 
Association for Computing Machinery (ACM), recognizing the social impact of 
their profession, drew up a code of ethics to articulate members’ responsibilities. 
One of these is to "respect the privacy of others". 


But, given the nature of the Net, individual users must also take responsibility. 
Here, then are some suggestions for protecting privacy in Cyberspace, adapted 
with their permission (and our gratitude) from a fact sheet of the Privacy Rights 
Clearinghouse at the Centre for Public Interest Law, University of San Diego, 
California. 
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Create a secure password Make up something nonsensical from a 
combination of upper and lower case letters, numbers and symbols, or 
something no-one could guess; a combination of family names, birthdates or 
interests. 


Ask for your system operator's privacy policy Most commercial services 
have written policies which they provide to new subscribers. Avoid those 
that don't. Read carefully all messages which appear at inital login; many 
"sysops" inspect e-mail and require new subscribers to allow e-mail to be 
monitored. 


Shop around Investigate new services before you use them. Post a question 
in a dependable forum or newsgroup. If others have had a bad experience, 
you will hear quickly—news gets around in cyberspace. 


Assume your communications are not private Unless you encrypt, do not 
send sensitive personal information (phone numbers, passwords, addresses, 
credit card numbers, vacation dates, social insurance numbers) by chat lines, 
forum postings, e-mail or in your on-line biography. 


Be cautious of "start-up" software Programs which make the initial 
connection to a service may ask for your credit card number, chequing 
account numbers, Social Insurance Numbers, then upload the information 
automatically for billing purposes. These programs may also be able to 
access records in your computer without your knowledge. Ask the service 
for alternate subscription methods. 


Don't leave footprints Use anonymous remailers to avoid leaving tracks of 
your logins and the commands you executed both at your service provider 
and remote sites. 


Remember the "Delete" command doesn't...make your messages disappear, 
that is. They can still be retrieved from back-up systems and your hard 
drive. 


On-line identities may not be what they seem Many network users adopt 
one or more on-line disguises. 


Avoid listing sensitive or controversial newsgroups as "favourites" If 
your on-line service allows you to compile a list of favourite newsgroups, 
avoid listing those with which you do not want to be publicly identified. 


Take care creating your on-line biography If you need to protect your 
identity, don't create a biography, and ask the operator to remove you from 
its on-line directory. Biographies may be searched system-wide or "fingered" 
remotely. 


Setting up a personal Web page makes you a marketing target This 
seems self-evident, but it's often forgotten. 


Be alert to social dangers Harassment, stalking, being "flamed"—subjected 
to emotional verbal attacks, or "spammed"—sent repeated unsolicited 
messages, are all possible on the Net. Women can be particularly vulnerable; 
use gender neutral on-line IDs. 


Teach your children well Make sure your children also learn the privacy 
lessons. Caution them against revealing information about themselves or 
your family. 


Use privacy protection tools If you are concerned, consider using 
technologies which help on-line users protect their privacy. These are: 


Encryption: these scramble e-mail messages or files, making them 
gibberish to both the system operator and anyone other than the 
intended recipient. Various encryption programs (such as PGP—Pretty 
Good Privacy) are available on-line; 


Anonymous remailers: these servers act as intermediaries for your 
message, stripping off the identifiers before forwarding the message; 


Memory protection software: programs which prevent unauthorized on- 
line access to your home computer. Some include an "audit trail" to 
record all activity on your computer. 


ple 


Canadian Institute for Health Information — 
a national medical record collection 


The 1993-94 annual report discussed the privacy issues in a new national body set 
up to gather personalized medical data from provincial health institutions and 
transform it into aggregate statistical data for research. Since the Canadian 
Institute for Health Information (CIHI) is not a federal agency, the 
Commissioner was concerned about removing sensitive medical data from the 
protection of the federal Privacy Act (and even tougher Statistics Act) with no 
compensating safeguards in place. He offered any input that might prove 
helpful to ensure that sensitive medical data was properly protected . CIHI's 
initial response was tepid but the past year has seen a sea-change. 


Background 

Until 1994, provincial health centres provided information about individual 
hospital admissions, treatments and deaths directly to Statistics Canada and 
Health and Welfare (covered by federal privacy legislation), as well as to two 
non-governmental organizations, the MIS Group and the Hospital Medical 
Records Institute. These agencies rendered the personalized data into aggregate 
statistics and made it available for research. 


A study by the National Council on Health Information concluded that the 
arrangement duplicated effort and produced overlapping responsibilities. The 
Council recommended integrating all the organizations’ relevant activities into a 
single tederally-chartered, non-profit organization with a mandate to create and 
maintain a completely integrated health information system for Canada. This ts 


CIE. 


Midway through 1995, CIHI seized on the privacy issue and determined to draw 
up guidelines on protecting the vast store of sensitive personal data of which it is 
custodian. Senior CIHI staff sought the office's input; the result is four 
documents on privacy and confidentiality, one of which—Privacy and 
Confidentiality of Health Information at CIHI—sets out the guidelines. They 


include: 


e 10 guiding principles governing collection, use and disclosure of personal 
information (based on the CSA Model Privacy Code); 


e = Security and Privacy Guidelines for Health Information Systems adopted from 
the Canadian Organization for the Advancement of Computers in Health 


(COACH); 
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e a data linkage policy modelled on Statistics Canada's Policy on Record 
Linkage, and 


* a formal process for handling external requests for CIHI data. 


These new guidelines will apply as minimum standards to all data under the 
control of CIHI. They will be implemented in 1996-97. 


Two questions remain. One is unsettling; is it advisable to centralize so much 
sensitive medical information given the unprecedented power for surveillance and 
linkage its systems grant health bureaucrats? And notwithstanding the security 
systems in place, concentration of data increases the potential for information 


leaks. 


The second question concerns the wisdom of CIHI piloting a national survey of 
some 22,000 Canadian households about their living habits, use of health services 
and their health problems. Previous health surveys were conducted under the 
stringent protection of the Statistics Act and the added safeguards of the Privacy 
Act. CIHI's guidelines are a brave statement of principle but they hold no power 
in law. 
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Update - The Privacy Patchwork 


The past year was a quiet one for new privacy laws in Canada and abroad. 


Alberta's Freedom of Information and Protection of Privacy Act came into force 
on October 1st. The law currently applies to provincial government records but 
will be extended to municipal and regional governments in the future. In 
November, British Columbia extended its Act to cover records of self-governing 
professional bodies such as the provincial College of Physicians and Surgeons—a 
first in Canada. 


The New Brunswick legislature established an all-party committee to examine 
comprehensive privacy legislation to replace the province's current privacy code. 
Residents now have a legal right of access to their personal records but none to 
challenge the government's collection, use and disclosure of their personal 
records. Nova Scotia has begun reviewing its 1993 Act for possible amendment. 
Prince Edward Island remains the only province without any kind of access to 
information or privacy legislation. 


Winnipeg appears to have broken new ground. In January, city council's new 
By-law relating to Access to Information came into force giving city residents rights 
of access to and correction of their personal information in city records 
(Manitoba's privacy law does not extend to regional and municipal governments). 


Abroad, Australia's federal government is considering extending its Privacy Act, 
which applies only to federal records, to the private sector. In July the 
European Parliament ratified the Directive on data protection, which is now in 
force. Member countries of the European Union have until the summer of 1998 
to adopt or adapt national privacy laws to comply with the Directive. Section 25 
of the Directive prohibits member nations (and businesses within the country) 
from transferring personal information to a non-member country whose laws do 
not guarantee adequate protection of the information. 


In the absence of nation-wide privacy protection laws covering both the 
governments and the private sector (except in Quebec), Canada may not meet the 
Directive's adequacy test and risks being at a trade disadvantage with other 
countries. 
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Investigating Complaints 


The Branch's intake of new complaints levelled off at 1625 during 1995-96. 
Investigators completed 1681 cases, leaving 1630 open case files—virtually an 
entire year's workload—to be carried into the next fiscal year. 


Two issues need highlighting in this report; both are the result of this huge 
backlog of complaints the Office continues to face. 


Like virtually all federal government institutions, the Office is struggling with 
dwindling financial resources. But the combination of across-the-board 
percentage cuts and climbing caseload has pushed the Office to the critical point 
far more quickly than larger agencies. The Commissioner is funded only to 
investigate and cannot turn away—or charge—complainants. 


Coupled with budget cuts are clients' increasing demands. Canadians 
demonstrate growing awareness of privacy threats, increased sophistication in 
framing complaints and a greater demand for respect for their privacy rights. 
More provinces have passed privacy legislation, there is a standard privacy code 
in the private sector, as well as a steady barrage of media stories about the 
dangers to privacy protection from technological advances. 


The Office recognizes that it will cease to be relevant if it cannot respond to 
complainants in a timely fashion—justice is already being seriously delayed. To 
serve clients properly, the Office should have no more than 500 complaint 
investigations open at any time; about 35 cases per investigator. 


The only option was to streamline the process substantially. In late 1995 the 
Office undertook an in-depth examination of its investigation process, including 
one-on-one meetings with staff in departmental privacy offices. The new process 
will reduce the paper burden, remove some of the formality, eliminate steps in 
the review process and allow greater reliance on the telephone—in short, a fast 
track approach to handling many of the complaints, one that builds on the 
strength and flexibility of the ombudsman role. 


At the same time, the Branch implemented quality service standards aimed at 
reducing the time and effort required to investigate complaints, created a unit to 
focus on backlogged complaints, and another to concentrate on complaints about 
improper collection, use, disclosure and disposal of personal records (sections 4 to 
8 of the Privacy Act). The Office will monitor the changes carefully, and fine- 
tune where needed. 
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Following are selected complaints from the year's caseload. 


Three strikes—CIC out 


Three times the owner of a Vancouver construction company returned packages 
of misdirected immigration files to the local Citizenship and Immigration Canada 
office. The fourth time, his patience ran out. He sent the file to the local 
Vancouver newspaper—the Province. 


Apparently the Surrey CIC office had closed and the priority courier, unable to 
find a current address, continued to deliver packages (addressed to "CIC") to the 
nearest likely destination—CIC Construction in West Vancouver. 


The journalist called the Vancouver CIC office. The manager reacted 
immediately, retrieving the file, calling the Montreal office to correct the address, 
and then the courier service which traced the deliveries. The courier 
acknowledged that the packages should have been returned, or instructions 
sought from the sender. The manager agreed to be interviewed and 
photographed but asked the journalist not to identify the subject of the file in 
the article. The journalist agreed but had already called the man for his reaction 
to the disclosure and asked him about his immigration status. Understandably 
upset, the man complained to the Commissioner. 


It was obvious that the immigration file (which contains photographs, 
fingerprints and sworn statements about his political background and reasons for 
seeking refuge in Canada) had been improperly disclosed. Despite three earlier 
opportunities, CIC had failed to determine why files were being returned or take 
proper measures to guarantee safe transfer of very sensitive personal information. 
Had they done so, the file would never have found its way to the newspaper, 
exposing the man to the journalist and to his probing questions. Fortunately the 
newspaper agreed not to compound the problem by naming the man in its 
article. 


The department apologized to the complainant. It also undertook to update its 
mailing lists, instruct employees on proper addressing and distribution of 
personal files and distribute information about the case to staff to illustrate the 
serious personal consequences of documents going astray. The complaint was 


well-founded. 


Privacy not a screen for defaulting loans 


Obviously not all complaints are well-founded. Privacy must sometimes give 
way before other demands—one of which is Canadians’ obligations to pay their 
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debts. The Office continues to receive complaints that Human Resources 
Development Canada has "improperly disclosed" information about their 
defaulted Canada Student Loan payments to private collection agencies. 


The government has a legitimate right and obligation to collect outstanding 
debts, and—having no collection agency of its own—it contracts debt collection 
to outside agencies. This does not violate the Privacy Act. Nevertheless, the 
Office ensures that contracts specify that agencies collection and use of the 
information does comply with the Privacy Act. 


Surplus employee can see successful candidates’ assessments 


Government lay-offs prompted a complaint, not from one of the employees 
declared surplus, but from one offered a position. He complained that Public 
Works and Government Services had provided its personal assessment of his 
performance to an unsuccessful candidate to justify its decision to offer him, and 
not the other employee, the job. 


In order to determine who would fill the remaining positions, Public Works 
developed selection criteria, established questions, a rating guide and the method 
of assessment for each job. From this process it established a list in reverse order 
of merit. Depending on the number of positions, employees were offered a 
position or declared surplus. Unsuccessful employees who grieved the process 
were provided the assessments of those ranked higher on the merit list. 


This disclosure follows Public Service Commission policy which provides the 
information to ensure the fairness of the process; the employee can see that 
he/she was fairly evaluated against objective criteria and against other employees. 
The department collected the information to establish the reverse order of merit 
list. It is entitled to disclose the list and assessments to aggrieved employees to 
defend its decisions in establishing its merit list. In short, the disclosure is 
consistent with the purpose for the original collection. The Commissioner was 
satisfied that the disclosure of the higher-ranked employees' personal information 
was in accordance with the Privacy Act. 


Must keep interview panel members' notes 


Several RCMP members complained that they were unable to examine notes 
made by panel members during various selection boards. Members take 
handwritten notes to help them assess and rank the candidates. Some board 
members had kept the notes for as long as six months in their own files. Others’ 
notes were shredded following the interviews, apparently on instructions from 
RCMP personnel staff. But ultimately all were destroyed—in two cases, between 
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the time the complainants sought access informally and then made formal 
requests. 


The Act is clear; personal information used by a government institution to make 
an administrative decision about an individual is accessible and should be kept for 
a minimum of two years. Several board members interviewed could see no 
difficulty with retaining the notes. In fact, next year's non-commissioned officer 
selection boards will include a candidate de-briefing which is likely to require 
board members to retain their notes to go over individuals’ answers to specific 
questions. 


The RCMP has agreed to change its policy and will gather members’ notes at the 
conclusion of the process and keep them in staffing files. 


Garnishment notice not an "improper disclosure" 


A Toronto woman argued that Revenue Canada's notice to her former employer 
that she owed back taxes was an improper disclosure of her personal 
information. 


After several attempts to collect the arrears (which the woman was trying to 
reduce by periodic payments), Revenue Canada sent her a "pre-legal" letter 
demanding a response in 15 days. When the letter and phone call to her 
workplace produced no response, Revenue Canada issued a "Requirement to Pay" 
notice against the employer. In the meantime, the woman had left the job and 
says she wrote to Revenue Canada to advise them. 


The investigator found no trace of a hard copy of the woman's letter or any 
entry in the taxation computer diary. Since Revenue Canada was attempting to 
collect taxes owing, did not know that she had left the job, and its authority is 
set out in the Income Tax Act, the Commissioner concluded that there had been 
no improper disclosure. 


Labour market survey not compulsory 


Statistics Canada's surveys always prompt telephone calls to the Commissioner. 
A Montreal woman complained that a Statistics Canada's labour market survey 
was an excessive collection of personal information that she was told she must 
provide. She also objected to the survey taker's demand for access to her future 
tax returns, as well as her telephone number or that of a family member or 
friend. The woman wanted the Office's help in refusing to answer Statistics 
Canada's questions. 
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It appeared that Statistics Canada had sent the woman a letter of introduction 
prior to taking the survey, explaining that the survey is voluntary. Unlike the 
Census, there are no legal obligations to respond to Statistics Canada surveys. 
An enthusiastic Statistics Canada staffer may have attempted to persuade the 
woman to participate and his or her persistence may have given the woman the 
impression she had to respond. However, the documents are clear, 


Since the study is a six-year longitudinal survey, participants are followed up at 
regular intervals. Statistics Canada asks for an alternate telephone number; for 
example, of family members or friends, if it is unable to reach the person for an 
extended period. 


The request for access to future tax returns was intended to help reduce the 
burden on respondents—much of the financial information needed for the survey 
duplicates details in individual tax returns. The question was apparently 
hypothetical—to assess respondents' willingness to approve such a disclosure. It 
was never made. 


The Commissioner concluded that Statistics Canada had the authority to conduct 
the survey, had properly explained its purpose and made it clear that 
participation was voluntary. Statistics Canada undertook not to approach the 
woman again although there is nothing to prevent her name from appearing at 
random in future surveys. 


MPs have no special access 


An individual complained that someone at Citizenship and Immigration had 
improperly disclosed information about him to a member of Parliament. The 
investigation confirmed that an immigration officer wrote to the MP providing 
information about the complainant's immigration status in Canada and his 
criminal record. 


While the Privacy Act allows departments to disclose personal information to 
MPs (with the individual's consent) for the member to help resolve the 
constituent's problem, MPs have no special access rights to other individuals’ 
records. In this case, the MP was not helping the person concerned. In fact, he 
was acting on behalf of the complainant's estranged wife. The department did 
not have the complainant's consent to disclose his information to the MP, nor 
was there any reason to do so. The Privacy Commissioner concluded that 
Citizenship had made an improper disclosure. 


Regrettably, once personal information has been disclosed, it cannot be retracted. 
There is no remedy that can undo the damage to the individual. However, the 
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department has assured the Commissioner that there will be no repeat of the 
incident. Citizenship officials agreed to develop and disseminate a policy to 
provide better direction to departmental officials responding to MPs' inquiries 
about its clients. 


Supervisor leaves; computer transferred—with employee files 


A Health Canada employee inherited a new computer from a departing 
supervisor and got more than simply more power. He found notes about 
another employee's performance on the hard drive and reported the discovery to 
a departmental official. 


Health Canada erased the information, apologized and has issued a directive to all 


staff to check computer hard drives before re-assigning them to other staff. 


Unfortunately, restoring the other employees privacy is impossible. The case is 
an object lesson for everyone who stores personal data on computers with little 
thought for the long-term consequences. Without help from their minders, these 
machines never forget. 


DND public affairs staff reveal details to media 


Government public affairs staff are often between the proverbial rock and hard 
place; criticized by the media for being secretive and, in this case, by family 
members for being too open. 


A young soldier died in tragic circumstances and his parents pressed for the 
details. Unsatisfied with DND's explanations, they went to the media. DND 
public affairs staff responded to journalists’ questions with details about the 
soldier's alcohol problems and DND's attempts to help him. In another 
interview, the public affairs officer also revealed that the soldier had not named 
his parents as next-of-kin to be called in an emergency. 


Video recordings of television interviews established two of the disclosures. A 
print journalist learned some of the details from one of the television interviews, 
not public affairs staff as the family maintained. 


Nevertheless, the Commissioner concluded that the disclosures were improper. 
DND will revise its policy and provide information sessions to guide public 


affairs officers when handling media demands for personal information. 


Human error misdirects mail 


Two instances of human error saw mail delivered to wrong addresses. 
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In the first case, a man's Change of Address card—the notice to the local Canada 
Post letter carrier to intercept and forward his mail—ended up being delivered to 
his former landlord. Canada Post apologized for what was an isolated incident. 


The second case was potentially far more damaging; a letter from Revenue 
Canada's Audit Services to a taxpayer was enclosed in material being mailed to a 
third party. Fortunately the recipient returned the letter to Revenue Canada; it 
contained information about the woman's income tax returns. 


Apparently Revenue Canada's Toronto East Tax Services Office provides mailing 
service to its Audit Services Branch. Mailing staff had gathered up the woman's 
letter inadvertently with other material. Revenue Canada apologized to the 
woman, has changed some mailing procedures and now conducts routine spot 
checks to try to prevent any recurrence. 


Employee tax guidelines working 


Last year we reported Revenue Canada's introduction of guidelines on using 
employees' tax files for supervision and performance assessment. This year an 
employee complained that Revenue Canada had breached those guidelines by 
using his tax files to make a case for firing him. 


The investigator examined the employee's personnel files and found that the 
employee and manager had repeatedly discussed his behaviour, absences from his 
desk and frequent personal phone calls. Concerned about the employee's low 
productivity and on-the-job activities, the manager asked for an Internal Affairs 
audit. 


The audit followed the trail left by the employee as he accessed key tax data 
available on Revenue Canada's computer system—selected tax items, not the 
complete return. The audit revealed that the employee had unauthorized access 
to his own tax data, as well as those of several family members and an 
acquaintance, none of which were needed for his job. It also revealed that 
despite having earned income, the employee had not filed a tax return for several 
years. 


However, the audit did not intentionally target the employee's tax data—it 
simply followed the trail he left which included accessing his own file. There 
were no tax details in his personnel files. While Revenue Canada ultimately fired 
the employee, it was due to his work habits, lack of productivity and 
unauthorized access to his own and others' tax data. The department also asked 
him to file tax returns for the missing years. 
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The Commissioner concluded that the complaint was not well-founded. Had the 
manager made a deliberate decision to investigate an employee's income tax 
return, the guidelines require him to provide substantial justification and obtain 
the approval of the assistant deputy minister. 


Inquiries 


Many callers cannot be helped because the Commissioner has no jurisdiction 
over the private sector; banks, insurance companies or transportation companies. 


Some callers were angry about Sprint Canada's request for customers’ SIN. 
Others objected to Purolator Courier requiring all employees to be fingerprinted. 
And several calls from Air Canada employees wanted investigators to examine 
the airline's use of personnel files and its access to employees’ e-Mail. 


Despite having been Crown corporations, neither Air Canada or Via Rail (also 
the subject of several inquiries) have ever been covered by federal privacy 
legislation. Employees have no legal right to examine their personnel records 
unless privacy rights are negotiated in collective agreements. 


OC Transpo 

Several calls from OC Transpo employees also denied access to their files 
illustrate the unusual status of the Ottawa-Carlton area's public transit company. 
Its regular routes to Hull, Quebec, make it an "Interprovincial" service and thus 
federally-regulated. However, it is not subject to federal privacy legislation, nor 
the Ontario privacy act which covers other Ontario transit authorities. 


According to the Ontario Privacy Commissioner's office, OC Transpo tries to 
follow the Ontario legislation. The Ontario Privacy Commissioner has been able 
to gain access to employee files except those dealing with harassment or grievance 
cases. These OC Transpo officials refuse to open. 


Old Age Security Card - SIN 

Three callers complained that their Social Insurance Number appears on their 
Old Age Security Cards, requiring them to reveal the SIN each time they use the 
card to identify themselves for benefits; for example, to get a seniors discount 
from a department store. Most of the callers declined to lodge a formal 
complaint, saying "it's not worth stirring up the hornet's nest". Clearly another 
senior disagreed because, shortly afterwards, the Office received a formal 
complaint which it is now investigating. 
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Personal Information Request Forms 

Dozens of callers complain they are unable to find the Personal Information 
Request Forms needed to access their personal records. Several had been 
improperly directed to post offices; Canada Employment Centres don't have 
them, as advertised, and many tell us the Employment Centre staff have never 
heard of the forms. Since distribution of the supporting materials is Treasury 
Board's responsibility, staff attempt to point out the gaps to TB staff as they 
occur. In the meantime, however, the Office ships thousands of forms each year. 


The forms and accompanying directory, Info Source, should be available in 
employment centres, federal government libraries and reading rooms, large public 
and university and college libraries, MPs' constituency offices and native band 
council offices. 
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Top Ten Departments by Complaints Received 
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Completed Complaints by Department and Result 
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Complaints Completed by Grounds 


Access 36% 


Innapropriate fees 0.1 % 


Use & Disclosure 
9.5% 


Collection 2.4 % 


Time Limits 40.4 % 


Origin of Completed Complaints 


Newfoundland 15 
Prince Edward Island 14 
Nova Scotia 50 
New Brunswick 34 
Quebec 172 
National Capital Region Quebec 17 
National Capital Region Ontario 349 
Ontario 510 
Manitoba 32 
Saskatchewan 49 
Alberta 132 
British Columbia 293 
Yukon 2 
Outside Canada 12 
TOTAL 1,681 
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Monitoring Compliance 


The Branch's portfolio system had a thorough workout this year. Less time was 
spent on formal audits and follow-ups; far more on consultation and discussion 
with government staff. This reflects the evolving trends in the public service; 
becoming more active and service oriented, 


Privacy staff are now more likely to be consulted early in program design and 
service delivery; in some cases, sitting on internal or interdepartmental 
committees to examine new initiatives. Two recent examples are the Office's 
work with Elections Canada on the permanent voters' register (see A Vote for 
Privacy? page 14) and ongoing discussions with the Justice Department on the 
new firearms registry. Preempting problems is the priority. 


An ounce of prevention... 


Ensuring compliance with the Privacy Act goes beyond auditing. Prevention also 
includes providing ongoing guidance to federal institutions. The timeliness of 
this guidance is crucial: the earlier the better. An increasing number of federal 
institutions recognize the benefits of involving portfolio leaders at the outset, 
whether developing new policy or launching activities which could affect clients’ 
and employees’ privacy. This year, staff dealt with many initiatives involving 
personal data; the following are some examples. 


Atomic Energy Control Board: miner exposure to radon 


Atomic Energy Control Board (AECB) sought the office's input when Dennison 
Mines asked AECB's consent to destroy files documenting workers' exposure to 
radon. Dennison had mined uranium in Elliot Lake during the 1950s and 1960s. 


AECB regulates atomic energy in Canada. Among its responsibilities is 
monitoring the health effects of radioactive substances on workers. AECB 
requires uranium mining companies to keep records of workers' exposure to 
radon—a known carcinogen. 


Rather than see destroyed an invaluable source of data for research into the long- 
term effects of radon exposure, AECB asked Dennison for the records. The 
company agreed. AECB was then faced with ensuring that its collection and use 
of this information complied with the Privacy Act. 


AECB anticipates matching the data with Statistics Canada's mortality database 


to determine the effects of exposure on employees’ lifespan and their mortality 
rates from lung cancer. The use is consistent with the mining companies' 
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original collection of the data — to monitor the health effects of exposure to 
radioactive substances. 


To ensure that the database meets privacy requirements, the portfolio leader 
confirmed that: 


e the research is part of AECB's responsibility—controlling health and safety 
aspects of radioactive substances; 


e the information was originally collected directly from the individuals 
concerned (although AECB collected it second-hand from Dennison Mines). 
Obtaining consent of former employees for the transfer to AECB would 
have proven extremely difficult since virtually all left Elliot Lake when the 
mines closed; 


® aretention schedule is in place. AECB intends keeping the information until 
the youngest miner has reached the age of 100 (assuming an age of 18 when 


hired); 


¢ one current use of the data is consistent with the original collection: at the 
request of the Ontario Workers' Compensation Board, AECB confirms ex- 
miners’ radon exposure to help the Board assess benefit entitlements for 
those diagnosed with lung cancer, and 


e workers have right of access to their data. AECB will establish a personal 
information bank to hold the records. This prepares a safe repository for 
similar records should other uranium mining companies close operations. 


Rideau Hall: Order of Canada nominees criminal record checks 


Last spring, the Chancellery at Rideau Hall approached our office to discuss 
submitting Order of Canada nominees to criminal record checks. Finding a 
recipient had a criminal record could put the reputation of the Order at risk. 
Staff suggested a compromise which could satisfy the Chancellery's needs and 
respect the nominees’ privacy. Nominees will be advised they have been 
recommended for the Order of Canada and asked to obtain confirmation from 
the RCMP that they have no criminal record or, if they prefer, to consent to the 
Chancellery verifying on their behalf. Nominees would then have the option to 
refuse, even if this meant withdrawing their names. 


RCMP: removing personal data from surplus equipment 


Following the revelation (in last year's annual report) that the Office had found 
RCMP documents in a safe it purchased from Crown Assets, the RCMP asked 
the portfolio leader to review a new section of its internal Security Manual 


48 


drafted to ensure that staff remove all information from surplus furniture before 
disposal. 


Communications Research Centre: employee phone records 


Telecommunications staff at the research centre (part of Industry Canada) asked 
for guidance on managers having access to employees telephone call records to 
contest long-distance charges or deal with suspected abuse of government long- 
distance lines. Privacy staff suggested advising employees before reviewing their 
call records and blocking out the last four digits of the number to protect the 
privacy of the party called. In fact, call records can be singularly unhelpful if 
employees deal regularly with the public from a central office which handles calls 
from across the country. 


Public Works and Government Services: automating security screening 


Screening potential government employees or contract staff for security and 
reliability is a huge job—PWGSC processes an estimated 29,000 a year. In an 
effort to simplify and automate the process, the department has developed the 
Personnel Screening Data Collection Automation System to reduce paperwork 
and turnaround time. 


The new system uses software designed to help private companies working on 
government contracts to gather and transmit personal data on employees who 
need security screening. The employer can load the software into a personal 
computer, gather the information and send it on line to the department. 
PWGSC will offer the service to 2,600 companies which do business with the 
federal government, as well as government departments and agencies. 


Given the amount and type of personal information required—family 
information and work history—the Office was concerned about making private 
sector organizations responsible for its collection and storage when they are 
subject to no privacy laws. 


The department provided privacy staff with the proposed security agreement to 
bind companies which have delegated authority to collect and store the screening 
information. The agreements will impose contractual obligations to protect the 
information in accordance with the Government Security Policy and spell out 
the government's ownership of the information. A pilot project is underway to 
test the system. 
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Public Service Commission: privacy clauses for outside surveys 


The Public Service Commission agreed to the portfolio leader's recommendations 
to change procedures following its disclosure to a survey firm of names, addresses 
and phone numbers of those using PSC recourse services. The company 
surveyed complainants to assess their satisfaction with PSC service. The most 
noteworthy change is the planned inclusion of clauses binding private companies 
to the provisions of the Privacy Act. 


RCMP: suspends ride along program 


Personal safety is a growing public concern. However, the RCMP agreed with 
the Office that exposing crime in a television program should not override the 
right of the individuals filmed during police patrols to be presumed innocent 
until tried in court. The RCMP interrupted its cooperation with the program To 
Serve and Protect, filmed in British Columbia, until producers agreed to blank 

out the faces, addresses and licence plates of the individuals—a common practice 
in similar U.S. programming. The RCMP undertook to develop a nation-wide 
policy on participating with communities and the media on fighting crime. 


Human Resources: using Internet 


The federal government too is on the Net. However, as governments go on-line, 
security of personal data is a pressing concern. Human Resources Development 
Canada(HRDC)—custodian of personal information on virtually every working 
Canadian—is the first to devise a federal policy on serving clients over the Net. 
HRDC sought the office's input to safeguard information collected from the 
general public visiting HRDC's Web site, and to prohibit transmission of 
personal information by Internet. HRD's policy should serve as a useful model 
for other government departments. (The Privacy Commissioner's own Web site 
is served by stand-alone terminals; there is no physical link to the internal 
network.) 


Human Resources: the Electronic Labour Exchange 


Another electronic project of HRDC is an Internet-based electronic labour 
exchange which "matches jobs to people and people to jobs". Employers use the 
exchange to specify the experience, skills and responsibilities of the position 
offered; job seekers describe their education, skills and experience. The exchange 
(an HRDC pilot project in the Ottawa area), attempts to bring the two together. 
Privacy staff offered HRDC guidance on collection and retention of job seekers’ 
profiles, as well as subsequent uses of the personal data for labour market 
analysis. 
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Audits 


The Privacy Act gives the Commissioner the power (and the discretion) to 
investigate federal government compliance with the act's fair information 
code—the rules governing collection, use, disclosure and disposal of individuals' 
personal information. 


Traditionally, the Office selects a handful of organizations and examines their 
information handling practices (or, when the organization is large, one aspect of 
their operations). Given the near impossibility of systematic auditing, the Office 
has shifted its emphasis to examining privacy issues government-wide. 


Nevertheless, the Office completed two audits during the past year—the 
Communications Security Establishment and the Canadian Centre for 
Management Development—and reviewed the internal compliance audit for a 
third—Canada Post's Central Division. 


Communications Security Establishment (CSE) 


CSE provides the federal government both the advice and the means to secure its 
own communications. It also provides the entire government with foreign 
"signals intelligence"; gathering and analyzing information about foreign 
countries by intercepting and studying their radio, radar and other electronic 
communications. CSE reports to the Minister of National Defence. 


This audit proved to be one of the more complex the Office has undertaken, for 
several reasons. First, the nature of the material gathered and handled by CSE is 
extremely sensitive and demanded high-level security clearances for Investigators, 
physical modifications to office space, and special equipment to process 
documents. 


Second, in the midst of the audit, there were several public allegations that CSE 
was gathering data about Canadians and monitoring their legitimate political 
activities. Unfortunately, the ensuing public debate, and revelation that the office 
was conducting a routine audit, may have raised unrealistic expectations as to 
what the Privacy Commissioner could report. 


Third, the Official Secrets Act also binds the Privacy Commissioner. This 


necessarily limits what he can report publicly. 


Finally, and most germane to the Office's investigation, is that CSE's mandate is 
not set out in enabling legislation (as with most other government agencies) 
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except those unspecified powers conferred on the minister under the National 
Defence Act. Privacy audits usually rely on enabling legislation to assess an 
organization's compliance with the Privacy Act. A legislated mandate is the 
benchmark against which an organization's information management is measured; 
what information is collected and how, and how it is used, disclosed and 
ultimately destroyed. The government has given CSE a stated rather than 
legislated mandate to conduct foreign signals intelligence. It was against this 
stated mandate that the Office assessed compliance. 


From a representative sampling of SIGINT data and reports, Office investigators 
concluded that CSE collects only information which serves the government's 
established foreign intelligence criteria. They found no evidence to support any 
allegations that CSE "targets Canadians" or monitors their communications. It is 
inevitable that any monitoring of foreign electronic communications will 
inadvertently trap information about some Canadians. However, CSE has strict 
procedures to minimize the possibility and to destroy any such information that 
does not meet government's foreign intelligence needs. Finally, the investigators 
also found that CSE's intelligence reports to government did not violate the act. 


Nevertheless, the government should introduce legislation establishing explicitly a 
legal framework and review mechanism for CSE's operating programs and 
activities. Not only would this allow its personal information management 
practices to be measured objectively, it would establish in law protection for 
Canadians' liberties—as well as a clear underpinning for CSE. Legislation would 
stimulate informed debate about the agency's mandate and better understanding 
of its activities. In short, more light; less heat. The timing appears right: as we 
go to press, the government announced it will establish an independent oversight 


body for CSE. 


Canadian Centre for Management Development (CCMD) 


CCMD provides management orientation and training courses to senior federal 
government managers and appointees. Its two National Capital Region campuses 
and Edmonton satellite office employ about 200 government and private sector 
researchers, professors and other staff. The Centre holds personal information 
about both staff and approximately 30 per cent of the almost 12,000 students 
who attend CCMD courses and seminars each year. (No personal information is 
gathered from the other participants.) 


This first audit of the CCMD examined how the Centre collects, keeps, uses, 


discloses, and protects its personal information holdings, and assessed employees' 
general knowledge and awareness of their obligations under the Privacy Act. 
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The audit identified several problems with the Centre's management of personal 
information. For example, files containing personal information were stored in 
insecure locations; some personal information holdings had not been identified 
and described in Info Source; disposal schedules had not been developed, or were 
not being applied, leading to information being stored longer than needed, and 
contracts requiring access to personal information did not bind contractors to 
comply with the Privacy Act. Before the audit, staff knew little about the 
requirements of the Act. This explains most of the shortcomings identified. 
However, staff understood the concept of "confidentiality" well, and were willing 
to learn. 


Privacy audit staff made several recommendations to the Centre, including: 


¢ within one year, implement a personal information management policy 
covering the entire cycle from collection to disposal; 


¢ properly organize, file and control circulation of its personal information 


holdings; 


* revise its forms to avoid collecting unnecessary personal details from students 
and to advise them of their rights under the Privacy Act; 


e with the help of the National Archives, implement a retention and disposal 
schedule for its personal information holdings, and review its current 
holdings to determine those which should be disposed of; 


¢ implement measures to protect its personal information holdings from 
unauthorized access; 


® exercise caution when transmitting personal information by fax; 


* — state in all contracts with third parties that the personal information to 
which they have access is under the control of the CCMD and subject to the 
Act: 


¢ educate current and new CCMD employees on these initiatives and about the 
requirements of the Act; and 


* accurately describe all of its information holdings in Info Source. 


CCMD reacted quickly to the recommendations and is taking action to deal with 
all issues raised. 


Canada Post Corporation - Huron Division 


Advised of the Office's planned audit, Canada Post reacted by launching its own. 
Spurred by discussion in the Privacy Commissioner's last annual report about 
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Huron Division managers keeping "shadow" files on their employees (and 
refusing access to the files under the Privacy Act), Canada Post's Central Area 
privacy office began examining former Huron Division files. 


The audit confirmed the problem of "shadow" files and led Canada Post to 
concrete action. Managers were told that they "may" retain in their personal 
files documents such as attendance calendars or other records needed to "support 
the supervision of employees, especially at remote work sites". However, two 
conditions were imposed: 


e these documents must only be copies of documents found in official 
employee files, and 


e the documents must be described in a new personal information bank listed 
in Info Source. 


Privacy staff examined the results of Canada Post's preliminary compliance 
review and concluded that the proposed changes to the corporations's business 
practices made it unnecessary for the Office to conduct its own audit at this 
point. Instead the Office will monitor complaints against Canada Post to help 
assess whether the corrective action produces a long-term solution. 


Citizenship & Immigration (CIC) 


Last year we reported recommendations from our audit of CIC's informatics 
system. CIC was (and still is) in the midst of a massive re-organization. Despite 
these pressures, CIC has prepared an action plan for each of the recommen- 
dations. It has also agreed to present specific compliance reports and action plans 
to respond to the Office's requests prompted by the audit. These include: 


e developing a department-wide plan for ongoing privacy training; 

¢ completely overhauling its listings in Info Source; 

e reviewing a sample of its information sharing agreements; 

® reviewing its retention and disposal schedules for personal records, and 


e reviewing its personal information collection and procedures to ensure 
compliance with the Privacy Act. 


Follow-ups 

This year, staff continued following up earlier audits to determine whether 
federal institutions complied with our recommendations. Once again, staff found 
a high degree of compliance. 
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Canadian Human Rights Commission (CHRC) Staff returned to the 
Commission, first audited in 1992. CHRC has begun addressing several 
problems the audit identified, including how the Commission describes, keeps 
and protects access to its paper and electronic files. CHRC has also developed 
guidelines for its staff on using fax machines to transmit sensitive complaint 
information. 


Some work remains to be done on three recommendations. The Commission 
has not conducted a complete security and risk assessment for areas where 
complaints are processed and stored. And while CHRC contracts now require 
outside contractors to respect the confidentiality of the information they process 
on its behalf, they do not contain satisfactory clauses clearly establishing that any 
personal information gathered is deemed to be under the control of the 
Commission and subject to the Privacy Act. Finally, the Commission's mailing 
lists need to be described in Info Source as a personal information bank, rather 
than a general information holding. 


National Research Council (NRC) Following the Office's 1992 audit, NRC has 
complied with all but one recommendation, and work on the one outstanding 
issue—weeding out old personal records—is well under way. 


NRC has 


e written explicit privacy language into its contracts with contractors providing 
Employee Assistance Plan services; 


e listed in Info Source its collection of personal information on employees who 
have undergone reliability checks; 


e — split its personnel files into three components to control access to the 
information, and destroyed duplicate dormant files maintained in a regional 
office, and 


¢ designed a segment for an existing course, Managing a Diverse Workforce, 
given nationally to improve employees' awareness of privacy law. The 
course is mandatory for managers, supervisors and all headquarters staff. 


National Defence (DND) DND has acted on all but three of the outstanding 
recommendations from the Office's 1991 audit. Those three concerned Canadian 
Forces Base Lahr, now closed. 


Royal Canadian Mounted Police (RCMP) All eight outstanding 
recommendations from the 1991 audit have been dealt with. They included 
creating a new information bank for Benefit Trust Fund records, amending other 
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bank descriptions, extending the retention period for some records to the 
required two years, and ensuring that crime victims consent before investigators 
give their names to victim's services volunteers. 


Information Sharing Study 


Background This year the branch analysed returns from its survey of 
government sharing and data matching of personal record holdings. The survey 
attempted to identify both disclosures under various information sharing 
agreements and "arrangements", and data matches—of which the Commissioner 
receives suspiciously few notifications. 


Statistics Canada staff advised on the structure of the questionnaire and an 
advisory committee guided the project and reviewed the findings. The Office 
distributed the survey to all deputy heads in February 1995 and completed data 
collection late in 1995. The final results are based on 107 of 109 institutions 
responding. Some blatant errors were corrected but generally the data was 
entered as reported. While the survey results are not exhaustive (and have not 
been verified), they are revealing. 


Why sharing needs tallying Although the Privacy Act protects clients' and 
employees’ personal information, the law allows several disclosures. One of 
these permits federal government agencies to share information under "an 
agreement or arrangement" with other levels of government and international 
organizations. However, the sharing is to be described publicly so that 
individuals understand how government uses and discloses their information. 
This is the "informed" part of informed consent. 


The Act is also clear that personal information collected for one purpose cannot 
be used for other unrelated purposes—this includes sharing between programs 
within a single department for which there is no provision. New uses for data 
are permitted if they are "consistent" with the original purpose, the 
Commissioner is notified and the new use described in Info Source. 
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The findings The results are summarized here. Datamatches were examined to 
determine whether they started before the Treasury Board's policy was put in 
place or, if after, whether the Commissioner was notified as required, 


Category Number 


Institutions surveyed 109 100 


Institutions responding 107 
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Institutions sharing internally 


Number of internal sharing arrangements 137 N/A 


Number reported in Info Source 


Institutions sharing externally 
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Data matches reported in 


Internal Sharing Few Info Source bank descriptions mention internal sharing 
clearly and explicitly. There are some oblique references to the program with 
which the information is shared, other examples require the reader to refer back 
to program records. There is often no apparent consistency between the new 
and original collection purpose. Finally, information from several programs is 
stored in an integrated computer system, providing staff access to (and, 
presumably, use of) all information in the system. 


Even those 70 cases of sharing which departments consider they have reported in 
Info Source are difficult to detect by experienced staff, let alone the public. They 


demand both careful perusal and liberal interpretation. 


External Sharing External sharing is reported more frequently in Info Source, 
occasionally (but not usually) citing a clear authority for the sharing—one listing 
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named "the Constitution of Canada" as the authority. No further details were 
provided. 


The number of sharing agreements and arrangements may appear high. 

However, they are inflated by two departments, Statistics Canada and Revenue 
Canada which together reported 434—more than 50 per cent of the total 861. Of 
this 434, 319 were covered by written agreements. 


Datamatching The survey reports 66 data matches; Info Source only six. Our 
already low expections were based on the 30 proposals submitted for the 
Commissioner's review since 1987. Departments have apparently lost track of 
even these 30 and public descriptions of the six are unclear. One institution's 
survey response maintained that it did not data match yet all its personal 
information bank descriptions state that the information may be used for 
datamatching. | 


There was another anomaly: some matches were reported by one institution, but 
not the other. Although the reporting institution may be considered the 
"matching" institution (and the other merely provided information), at the least 
the information provider should report the disclosure as external sharing. This 
was not the case. 


Only eight internal data matches were reported; surprising given the proliferation 
of computer systems. 


While Treasury Board's instructions on conducting a data match are clear, some 
privacy coordinators seem unsure about its application. The result: neither the 
public or the Commissioner is being told. Far greater cooperation is needed 
between departmental privacy coodinators and the program staff who devise the 
matching proposals. 


Conclusions It is evident that the returned questionnaires are not always 
accurate or complete; for example, they revealed: 


¢ incomplete responses to questions on the existence of written agreements to 
cover an activity; 


e no list of personal information banks which describe a sharing or matching 
activity; 


e information the Office knows to be inaccurate; 
e failure to list data matches reviewed by the Office, and 


e suspected under-reporting of both matching and sharing. 
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While it may be risky to draw conclusions from the returns, one thing is 
clear—Info Source is a difficult tool to use in its present form, even for 
experienced staff. It demands careful perusal to determine the extent of 
government datamatching, or consistent uses departments make of personal 
information under its control. Even then, the references are often oblique. 


Our sympathy is with uninitiated readers trying to find their way through this 


thicket. It's time for the government to be much clearer and more forthright on 
its uses of clients' and employees’ data. 
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In the Courts 


Minister of Finance v. Michael Dagg 


The Supreme Court of Canada has agreed to hear Mr. Dagg's appeal of a lower 
court decision denying him access to the Department of Finance's after-hour 
employee sign-in sheets. The Privacy Commissioner will intervene in the case. 


Last year's annual report described the Federal Court of Appeal's decision (see 
page 26) which established clearly that the Privacy Act and the Access to 
Information Act are of equal status. Once information sought under the Access 
Act is found to be "personal", it may only be given to third parties if disclosure 
is permitted by the Privacy Act. 


The Court has yet to set a date for the hearing. 


Rubin v. Clerk of the Privy Council 


This case, although brought under the Access to Information Act, also has 
significance for the Privacy Commissioner because an identical provision appears 
in section 33(2) of the Privacy Act. 


The Supreme Court confirmed a lower court deicison that no-one has a right to 
have access to another person's representations to the Information Commissioner 
and that confidentiality continues, even when the investigation is completed. 

Mr. Rubin had argued that the confidentiality of representations should end, 
once the investigation is finished. 


The ruling suggests that the Court would reach a similar conclusion about 
representations to the Privacy Commissioner. 


Privacy Commissioner v. Canada Labour Relations Board 


The Federal Court heard this case early in June. The case, reported in some 
detail in the 1994-95 report (see page 27) concerns access to personal information 
contained in handwritten notes taken by Board members at a labour relations 
hearing. The decision is expected in the Fall. 
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Taking the Show on the Road 


Despite government's apparently firm conviction that the Privacy Commissioner 
has no education role (and certainly needs no money to inform Canadians) 
taxpayers think otherwise. The Office handled 1304 publication and media 
requests and there were more than 30,000 visits to the Commissioner's new Web 
site. In fact, the Office was one of the first dozen federal agencies to establish a 
site as part of the Open Government pilot project. In addition to providing the 
Office's information and publications, the site links to other privacy sites. 


Commissioner and staff gave more than 30 speeches this year—and had to 
gracefully decline almost as many. The cupboard is bare. 


Consumers, business, professionals and the media are alive to privacy as an issue. 
The recent survey by Ekos Research Associates for the Public Interest Advocacy 
Centre (PIAC) and the Fédération nationale des associations de consommateurs 
du Québec (FNACQ) demonstrates the public's growing concern. 


Overwhelmingly Canadians want to be informed about the collection of their 
personal information and the uses to which it is put. They insist that their 
permission be obtained before their information is passed to another 
organization. And 87 per cent think government should treat the issue as a 
priority. (Copies of the entire report are available from PIAC in Ottawa and 
FNACQ in Montreal.) 


Among the speaking engagements, Commissioner and staff spoke about the 
privacy implication of information technology to 

e the Canadian Telecommunications Superconference; 

e the 11th annual General Assembly of the World Teleport Association; 
¢ the annual Winter Cities conference of northern mayors; 


e the Communications Security Establishment's annual computer Security 
Conference, and 


e the University of Victoria's Leading Edge Technologies conference. 


Interest in bringing the law into the information age led to speeches to the 
Canadian Bar Association and the Commissioner delivering 


¢ the Law Society of Manitoba's annual Isaac Pitblado lecture; 
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e the annual IP Sharp lecture to the University of Toronto's Information 
Management faculty, and 


e a Legislative Library Noon-Hour talk to New Brunswick legislators, staff and 
the public. 

Where to draw the line on DNA testing—in criminal investigations and insurance 

underwriting—were the subject of speeches to 

e the Genetics and the Law symposium at Osgoode Hall, Toronto, and 


e the annual conference of the Canadian Life Insurance Medical Officers' 
Association in Regina. 
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Corporate Management 


The Privacy and Information Commissioners share premises and administrative 
services but operate independently under their separate statutory authorities. 
Corporate Management Branch provides centralized administrative services to 
avoid duplication of effort and realize cost savings to the government. The 
services include finance, personnel, information technology advice and support, 
telecommunications, library services and general administration. 


The Branch has just 15 staff (who perform a variety of tasks) and a budget 
representing 15 per cent of the overall OIPC budget. Subject to modest savings 
through information technology, the Branch has gone as far as it reasonably can 
to simplify and streamline service delivery. 


Resource Information 


The Offices' combined Main Estimates for the 1995-96 fiscal year were 
$6,186,000, a decrease of $236,000 over 1994-95. Actual expenditures for the 
1995-96 period were $6,516,792 of which, personnel costs of $5,435,439 and 
professional and special services expenditures of $565,170 accounted for more that 
92 per cent of all expenditures. The remaining $516,183 covered all other 
expenditures including postage, telephone, office equipment and supplies. 


Figure 1: 1995-96 Resources by Organization/Activity 


HUMAN RESOURCES FINANCIAL RESOURCES 

(FULL-TIME EQUIVALENTS) ($000) 
Information Information 

33 (38%) 2680 (41%) 


Administration 


Administration 
955 (15%) 


15 (17%) 


Privacy Privacy 
38 (44%) 2882 (44%) 
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Figure 2: Details by Object of Expenditure 


Information Privacy Corporate Total 
Management | 

Salaries 1,938,644 2,252,614 585,181 4,776,439 

Employee Benefit Plan Contributions 262,400 307,570 89,030 659,000 
Transportation and Communication 56,724 yf A 92,391 221,438 | 
Information 27,046 46,635 5,376 79,057 , 
Professional and Special Services 302,101 168,871 94,198 565,170 : 
Rentals 2,302 589 13,766 16707 
Purchased Repair and Maintenance 4,695 143 8,957 | 13,795 | 
Utilities, Materials And Supplies 24,350 12,864 57-752 74,966 : 
Acquisition of Machinery and Equipment 61,328 19,375 28,429 109,132 | 
Other Payments 576 512 - 1,088 | 
Total 2,680,216 2,881,496 955,080 6,516,792 | 


* Expenditure Figures do not incorporate final year-end adjustments reflected in the 
Offices’ 1995-96 Public Accounts. 
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Organization Chart 
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